Arbitrary Script Execution Flaw in Advanced Custom Fields Plugin by WordPress
CVE-2026-94264
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 23 October 2026
Badges
What is CVE-2026-94264?
The Advanced Custom Fields: Extended plugin for WordPress prior to version 0.9.2.8 is susceptible to an arbitrary script execution vulnerability. This arises from improper validation and escaping of form shortcode attributes, allowing users with minimal privileges, such as a contributor, to inject and execute harmful scripts in the browsers of users who open crafted links or pages. Even logged-in administrators are at risk if they engage with affected content. This issue is recognized as an incomplete fix related to a previously known vulnerability.
Affected Version(s)
Advanced Custom Fields: Extended 0.8.9.4 < 0.9.2.8
Advanced Custom Fields: Extended PRO 0.8.9.4 < 0.9.2.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.