---
id: CVE-2026-94264
title: >-
  Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form
  Shortcode Attributes
summary: >-
  The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced
  Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate
  or escape some of its form shortcode attributes, which can be pointed at
  values …
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-79
product: 'Advanced Custom Fields: Extended'
affected:
  - advanced_custom_fields_extended >= 0.8.9.4 < 0.9.2.8
  - advanced_custom_fields_extended_pro >= 0.8.9.4 < 0.9.2.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-23T10:36:00.400070Z'
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T10:46:02.895Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-94264'
references:
  - url: 'https://wpscan.com/vulnerability/4475b8a6-0d25-49b2-b973-5e19b8958595/'
tags:
  - cve.org
ingestedAt: '2026-10-23T06:17:25.169Z'
---

## Overview

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator.
This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.

## Affected

- `advanced_custom_fields_extended >= 0.8.9.4 < 0.9.2.8`
- `advanced_custom_fields_extended_pro >= 0.8.9.4 < 0.9.2.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.