CVE-2026-112313 ACF Extended CVE debrief

Who should care

Defenders responsible for WordPress installations with the ACF Extended plugin should assess exposure and prioritize updates or mitigations.

Why it matters

CVE-2026-112313 is a stored XSS vulnerability in ACF Extended plugin versions up to 0.9.2.7. Defenders should prioritize verifying and updating plugin versions, implementing input validation and output encoding, and monitoring plugin updates and security advisories.

• Defenders must verify ACF Extended plugin versions to prevent potential XSS attacks
• XSS attacks could lead to unauthorized script injection and compromise of web pages
• Defenders should implement input validation and output encoding to prevent XSS attacks
• Defenders must monitor plugin updates and security advisories to ensure timely patching

Technical summary

The ACF Extended plugin for WordPress has a stored XSS vulnerability in versions up to 0.9.2.7. An attacker could exploit this vulnerability to inject malicious scripts into web pages. This Cross-site Scripting vulnerability is due to improper neutralization of input during web page generation. Defenders should prioritize verifying and updating ACF Extended plugin versions to prevent potential XSS attacks. Implementing input validation and output encoding can help prevent XSS attacks.

Defensive priority

Defenders should prioritize verifying and updating ACF Extended plugin versions to prevent potential XSS attacks.

Recommended defensive actions

• Verify ACF Extended plugin version and update to a non-affected version if necessary
• Implement input validation and output encoding to prevent XSS attacks
• Monitor plugin updates and security advisories

Evidence notes

The CVE record and source item provide information on the XSS vulnerability in ACF Extended plugin versions up to 0.9.2.7. The vulnerability is a stored XSS issue, which could allow an attacker to inject malicious scripts into web pages. Defenders should verify ACF Extended plugin versions to prevent potential XSS attacks. The source item provides details on the vulnerability, but the scope of affected systems and potential impact are not explicitly stated. Further verification is

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.