CVE-2026-94264 | Advanced Custom Fields Extended Plugin up to 0.9.2.7 on WordPress Shortcode Attributes cross site scripting

October 23, 2026 Yanac

A vulnerability was found in Advanced Custom Fields Extended Plugin and Advanced Custom Fields Extended PRO Plugin up to 0.9.2.7 on WordPress. It has been classified as problematic. Affected by this issue is some unknown functionality of the component Shortcode Attributes. The manipulation leads to cross site scripting.

This vulnerability is documented as CVE-2026-94264. The attack can be initiated remotely. There is not any exploit available.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More