CVE-2026-94264 Advanced Custom Fields: Extended CVE debrief

Who should care

Defenders responsible for WordPress installations using the Advanced Custom Fields: Extended plugin should be aware of this vulnerability and take steps to mitigate it. This includes updating the plugin to version 0.9.2.8 or later and monitoring for suspicious activity.

Why it matters

The Advanced Custom Fields: Extended WordPress plugin is vulnerable to cross-site scripting (XSS) attacks, allowing users with contributor-level access or higher to inject malicious scripts. Defenders should prioritize updating the plugin and monitoring for suspicious activity.

• Defenders need to verify and update vulnerable plugin versions to prevent exploitation.
• Defenders should monitor WordPress installations for suspicious activity related to this vulnerability.
• Defenders need to ensure proper configuration of user roles and permissions to limit exposure.

Technical summary

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.

Defensive priority

Defenders should prioritize updating the Advanced Custom Fields: Extended plugin to version 0.9.2.8 or later, as this version includes a fix for the XSS vulnerability. Additionally, defenders should monitor their WordPress installations for any suspicious activity and ensure that all user roles and permissions are properly configured.

Recommended defensive actions

• Update the Advanced Custom Fields: Extended plugin to version 0.9.2.8 or later
• Monitor WordPress installations for suspicious activity
• Review and configure user roles and permissions
• Verify affected product deployments exist in managed environments
• Review compensating controls for exposed systems while remediation is scheduled
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details about the vulnerability, including its impact and affected versions. However, the record does not provide information on known exploitation or specific attack vectors.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.