Read the docs
TI-2026-79557 Aliases CVE-2026-94264GHSA-x437-3m7g-hfr2

XSS in Advanced Custom Fields: Extended via shortcode attributes

Priority LOW 32CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

The Advanced Custom Fields: Extended WordPress plugin from 0.8.9.4 before 0.9.2.8 and Advanced Custom Fields: Extended PRO from 0.8.9.4 before 0.9.2.8 do not validate or escape some form shortcode attributes. Attributes can take values from the visitor's own request and output them unescaped, which is cross-site scripting (CWE-79). A contributor-level user or higher can make scripts run in the browser of anyone who opens a crafted link or page, including a logged-in administrator. The fix is incomplete for CVE-2023-5292, whose deny-list covers only three HTML wrapper attributes.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00306 23rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Advanced Custom Fields: Extended (Unknown): 0.9.2.8Advanced Custom Fields: Extended PRO (Unknown): 0.9.2.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownAdvanced Custom Fields: Extended0.8.9.4 to before 0.9.2.80.9.2.8Patch availableCNA
UnknownAdvanced Custom Fields: Extended PRO0.8.9.4 to before 0.9.2.80.9.2.8Patch availableCNA
  • Advanced Custom Fields: Extended VendorUnknown Affected 0.8.9.4 to before 0.9.2.8 Fixed in 0.9.2.8 Patch available CNA
  • Advanced Custom Fields: Extended PRO VendorUnknown Affected 0.8.9.4 to before 0.9.2.8 Fixed in 0.9.2.8 Patch available CNA

Remediation

Update Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO to version 0.9.2.8.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Advanced Custom Fields: Extended (Unknown) Fixed in 0.9.2.8
  • Fix · CNA Advanced Custom Fields: Extended PRO (Unknown) Fixed in 0.9.2.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Advanced Custom Fields: Extended, Advanced Custom Fields: Extended PRO 0.9.2.8

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-79558 Unauthenticated code execution in Advanced Custom Fields: ExtendedPriority MEDIUM 41
    • TI-2026-79559 Privilege management flaw in Advanced Custom Fields: Extended pluginsPriority LOW 37
    • TI-2026-79556 Account takeover in Advanced Custom Fields: Extended front-end formsPriority LOW 37
    Show all 5 records →

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-94264
  2. 2026-10-23 Alias added: GHSA-x437-3m7g-hfr2
  3. 2026-10-23 CVSS score added · CISA ADP
  4. 2026-10-23 Weakness changed · CISA ADP
  5. 2026-10-23 CISA SSVC decision points changed

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences