ACF Extended and ACF Extended PRO: Script injection through form shortcode attributes
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: Both editions: 0.8.9.4 to before 0.9.2.8. The narrative names the role described above, while the CVSS vector records high privileges (PR:H); that vector does not establish an Administrator-only requirement.
- Component
- Advanced Custom Fields: Extended, Advanced Custom Fields: Extended PRO
- Plugin slug
acf-extended- Affected
- Both editions: 0.8.9.4 to < 0.9.2.8
- Safe version
0.9.2.8- Published
- Oct 23, 2026
This CVE was published Oct 23, 2026 and is one of 15 known issues for this plugin.
Update, patch or deactivate.
Update either affected ACF Extended edition to 0.9.2.8 or a later supported release. Validate and contextually escape every request-backed form-shortcode attribute, not only the three wrapper attributes covered by the earlier denylist.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H