{"id":"CVE-2026-94263","revision":"45d3a8679caf49cebcb0b2eeaba9d533","records":[{"revision":"45d3a8679caf49cebcb0b2eeaba9d533","observedAt":"2026-10-23T16:01:20.601+00:00","statement":{"source":"cve-program","id":"CVE-2026-94263","aliases":[],"title":"Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message","description":"The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.","state":0,"publishedAt":"2026-10-23T10:44:12.568+00:00","modifiedAt":"2026-10-23T10:52:24.979+00:00","affected":[{"ecosystem":"https://wordpress.org/plugins","name":"Advanced Custom Fields: Extended","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"Advanced Custom Fields: Extended\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"0.9.2.4\",\n                            \"lessThan\": \"0.9.2.8\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"collectionURL\": \"https://wordpress.org/plugins\"\n                }"},{"ecosystem":"Vendor product","name":"Advanced Custom Fields: Extended PRO","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"Advanced Custom Fields: Extended PRO\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"0.9.2.4\",\n                            \"lessThan\": \"0.9.2.8\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":4.8,"severity":"MEDIUM"}],"references":["https://wpscan.com/vulnerability/52f1633a-21ae-4273-8f24-5c10c2a92a8b/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-94263","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-94263","identifiers":["CVE-2026-94263"]},"retained":false,"historicalAffected":[]}],"coverage":[]}