The ACF Extended plugin for WordPress has a stored XSS vulnerability in versions up to 0.9.2.7. This Cross-site Scripting vulnerability allows an attacker to inject malicious scripts into web pages. Defenders should assess exposure and prioritize updates or mitigations for WordPress installations with the ACF Extended plugin. The CVE record was published on 2026-10-22T10:00:12.776Z and has not been modifi [truncated]
The CVE-2026-112311 vulnerability in the WordPress ACF Extended plugin allows for arbitrary file deletion due to improper limitation of a pathname to a restricted directory, also known as path traversal. This issue affects versions of the plugin from n/a through 0.9.2.7. The CVSS score for this vulnerability is 6.5, indicating a medium severity level.
The CVE-2026-112312 vulnerability affects the WordPress ACF Extended plugin, versions up to and including 0.9.2.7. This vulnerability is classified as a Broken Access Control issue, with a CVSS score of 7.5 and a HIGH severity rating. The vulnerability allows for Exploiting Incorrectly Configured Access Control Security Levels due to missing authorization.
