CVE-2026-94264 in Advanced Custom Fields Extended Plugin
Summary
by MITRE • 10/23/2026
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The Advanced Custom Fields: Extended WordPress plugin and its PRO variant prior to version 0.9.2.8 contain a critical cross-site scripting vulnerability stemming from insufficient input validation and output escaping mechanisms within their form shortcode implementation. This flaw allows attackers with low-privileged accounts, such as contributors or subscribers, to inject malicious client-side script code into web pages viewed by other users. The root cause lies in the plugin's failure to properly sanitize attributes passed through shortcodes that are derived directly from user-controlled request parameters. When these unvalidated values are rendered on a page without appropriate escaping, they execute arbitrary JavaScript within the context of the victim's browser session. This specific vulnerability represents an incomplete remediation effort regarding CVE-2023-5292, as the previous security patch only addressed three HTML wrapper attributes while neglecting other susceptible input vectors that remain exposed to injection attacks.
From a technical perspective, this flaw is classified under CWE-79, which denotes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The vulnerability operates by exploiting the dynamic nature of WordPress shortcodes where user-supplied data is interpolated into HTML output without adequate sanitization checks. An attacker can craft a malicious link or page containing specific shortcode attributes that embed JavaScript payloads. When an administrator or any other privileged user visits this crafted content, their browser executes the injected script. This execution occurs within the security context of the WordPress site, granting the attacker access to session cookies, authentication tokens, and potentially sensitive administrative functions depending on the victim's role. The persistence of this issue in versions before 0.9.2.8 indicates a gap in the comprehensive application of input validation rules across all shortcode attributes rather than just a subset defined by previous patches.
The operational impact of this vulnerability is significant due to its potential for widespread exploitation and high privilege escalation capabilities. Since only contributor-level access or even public visibility is required to trigger the attack, the barrier to entry for malicious actors is extremely low. Successful exploitation can lead to session hijacking, where an attacker steals administrative cookies to gain full control over the WordPress installation. It also enables defacement of website content, redirection of users to phishing sites, and theft of sensitive data stored within the application or associated databases. Furthermore, because this is a continuation of CVE-2023-5292, it suggests that previous mitigation strategies were insufficiently thorough, leaving residual attack surfaces open for exploitation by automated scanning tools and opportunistic attackers targeting WordPress ecosystems.
To mitigate these risks, immediate action must be taken to update the Advanced Custom Fields: Extended plugin and its PRO version to 0.9.2.8 or later, which addresses this incomplete fix by implementing robust input validation and output escaping across all affected shortcode attributes. Administrators should also enforce strict role-based access controls to limit who can create content containing shortcodes until patches are applied. Implementing a Web Application Firewall with rules specifically tuned for detecting cross-site scripting patterns in URL parameters and form submissions provides an additional layer of defense. Regular security audits focusing on the sanitization of dynamic user inputs in WordPress plugins are essential to prevent similar vulnerabilities from persisting or emerging due to partial remediation efforts. Monitoring server logs for unusual activity related to shortcode usage can also aid in early detection of exploitation attempts.