CVE-2026-94263 | Advanced Custom Fields Extended Plugin up to 0.9.2.7 on WordPress Shortcode injection (EUVD-2026-108668)

October 23, 2026 Yanac

A vulnerability described as critical has been identified in Advanced Custom Fields Extended Plugin and Advanced Custom Fields Extended PRO Plugin up to 0.9.2.7 on WordPress. The affected element is an unknown function of the component Shortcode Handler. The manipulation results in injection.

This vulnerability is known as CVE-2026-94263. It is possible to launch the attack remotely. No exploit is available.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More