CVE-2026-112313 in ACF Extended Plugin
Summary
by MITRE • 10/23/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects ACF Extended: from n/a through 0.9.2.7.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The identified vulnerability represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. Specifically, this is classified under CWE-79 in the Common Weakness Enumeration framework, which addresses flaws where user-controllable input is not properly validated before being included in web pages sent to other users. In the context of ACF Extended, a popular plugin for WordPress that enhances Advanced Custom Fields functionality, this flaw manifests as a Stored XSS vulnerability. Unlike reflected XSS attacks where malicious scripts are executed immediately upon request processing, stored vulnerabilities persist on the target server, typically within a database or file system, and are served to victims during normal page loads. This distinction significantly increases the severity of the issue because it allows an attacker to inject persistent payloads that affect multiple users over time without requiring further interaction from the initial injection point.
The technical root cause lies in insufficient sanitization and output encoding mechanisms within versions 0.9.2.7 and earlier of ACF Extended. When user-supplied data is processed by the plugin, it fails to adequately escape special characters that have meaning in HTML contexts, such as angle brackets, ampersands, or quotes. Consequently, when this untrusted input is rendered on a web page for other users, the browser interprets the injected code as executable JavaScript rather than plain text. This failure occurs because the application does not adhere to strict output encoding standards relative to the context in which the data is being displayed. The lack of proper neutralization allows arbitrary script execution within the security context of the website, effectively bypassing same-origin policies that are designed to prevent malicious scripts from accessing sensitive information on other domains or even within the same domain if privileges differ.
From an operational impact perspective, a successful exploitation of this Stored XSS vulnerability can lead to severe consequences for both end-users and site administrators. Attackers can execute arbitrary JavaScript code in the context of the victim's browser session. This capability enables several malicious activities including but not limited to stealing session cookies, which could allow the attacker to hijack user sessions and impersonate legitimate users. It also facilitates keylogging capabilities, allowing the capture of sensitive input such as passwords or credit card numbers entered on the site. Furthermore, attackers can manipulate DOM elements to deface the website's appearance, redirect users to phishing sites, or perform actions on behalf of authenticated users if they have elevated privileges like administrators. The persistent nature of stored XSS means that every user who views a compromised page is potentially exposed, amplifying the blast radius significantly compared to one-time attacks.
In terms of threat modeling and adversary behavior, this vulnerability aligns with techniques observed in real-world cyber operations as defined by the MITRE ATT&CK framework. Specifically, it relates to T1059 Command and Scripting Interpreter through JavaScript execution within a browser environment. Attackers often leverage such vulnerabilities for initial access or privilege escalation if they can trick an administrator into viewing malicious content. The persistence of the payload allows attackers to maintain long-term access without needing to re-inject code repeatedly, making detection more difficult as the malicious script becomes part of the legitimate site's data stream. This aligns with broader strategies aimed at compromising user integrity and confidentiality through client-side exploitation rather than server-side intrusion alone.
To mitigate this vulnerability, immediate action is required for all systems running ACF Extended versions prior to 0.9.2.8. The primary remediation step involves upgrading the plugin to version 0.9.2.8 or later where these input validation and output encoding issues have been addressed by the developers. Until an upgrade can be performed, administrators should implement compensating controls such as Web Application Firewall rules that detect and block common XSS payloads in HTTP requests. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact of any successful injection by restricting the sources from which scripts are allowed to execute. Regular security audits and code reviews focusing on input sanitization practices are also recommended to prevent similar flaws in custom development or other plugins that handle user-generated content.