MEDIUM 4.8 NVD

CVE-2026-94263

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode pr

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.

References

https://wpscan.com/vulnerability/52f1633a-21ae-4273-8f24-5c10c2a92a8b/

Published: 2026-10-23 · Source: NVD · Feed updated: 2026-10-23

This medium severity vulnerability with a CVSS score of 4.8 was published on 2026-10-23 via NVD.

vulnfeed aggregates 15176 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.