Medium
4.8
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins...
CVE-2026-94263
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| https://wordpress.org/plugins | Advanced Custom Fields: Extended |
≥ 0.9.2.4, < 0.9.2.8 |
0.9.2.8 |
| CVE | Advanced Custom Fields: Extended PRO |
≥ 0.9.2.4, < 0.9.2.8 |
0.9.2.8 |
Original description The description as published by the source.
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web contact@wpscan.com
- web nvd.nist.gov
- web wpscan.com
- web github.com