CVE-2026-94264mediumCWE-79

CVE-2026-94264: falha de média gravidade em Advanced Custom Fields: Extended

Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes

Publicada em

Seguir esta CVE+ Monitorar Advanced Custom Fields: Extended+ Monitorar Advanced Custom Fields: Extended PRO

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

33Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 6.8epss 0.3%
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Unknown · Advanced Custom Fields: ExtendedUnknown · Advanced Custom Fields: Extended PRO
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Advanced Custom Fields: Extended

No mesmo produto, das mais perigosas para as menos.

CVE-2021-24865—Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL InjectionEPSS 1.5%CVE-2026-94267CRITICALAdvanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update ActionEPSS 0.4%CVE-2026-80467HIGHAdvanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert ActionEPSS 0.4%CVE-2026-12526HIGHAdvanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update ActionEPSS 0.4%CVE-2026-94268HIGHAdvanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update ActionEPSS 0.3%CVE-2026-94262HIGHAdvanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update ActionEPSS 0.3%