Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: Advanced Custom Fields: Extended, Advanced Custom Fields: Extended PRO 0.9.2.8 Clear all filters
TI-2026-79605 CVE-2026-94263 · GHSA-p7mg-pc34-v9p7

Unauthenticated shortcode execution in Advanced Custom Fields: Extended

Priority LOW 21

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end form…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.002 Published 2026-10-23 Fixed in 0.9.2.8 CWE-74
TI-2026-79559 CVE-2026-94268 · GHSA-5c6h-7vg8-f3f2

Privilege management flaw in Advanced Custom Fields: Extended plugins

Priority LOW 37

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms modu…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00322 Published 2026-10-23 Fixed in 0.9.2.8 CWE-269
TI-2026-79558 CVE-2026-94267 · GHSA-69cf-82p8-9425

Unauthenticated code execution in Advanced Custom Fields: Extended

Priority MEDIUM 41

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its fro…

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.00394 Published 2026-10-23 Fixed in 0.9.2.8 CWE-94
TI-2026-79557 CVE-2026-94264 · GHSA-x437-3m7g-hfr2

XSS in Advanced Custom Fields: Extended via shortcode attributes

Priority LOW 32

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be p…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00306 Published 2026-10-23 Fixed in 0.9.2.8 CWE-79
TI-2026-79556 CVE-2026-94262 · GHSA-8j7c-fxr7-7933

Account takeover in Advanced Custom Fields: Extended front-end forms

Priority LOW 37

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user accoun…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00287 Published 2026-10-23 Fixed in 0.9.2.8 CWE-863