CVE-2026-94264

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins (versions before 0.9.2.8 ) are vulnerable to Cross-Site Scripting (XSS) . The root cause is a failure to validate or escape certain form shortcode attributes , which can be manipulated using values fro...

CVE-2026-94264 Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output...