ACF Extended CVE-2026-94264

Exploitation requires an authenticated account on the target WordPress site with at least contributor-level privileges, AND the site must use an ACF Extended form shortcode with one of the unescaped attributes populated from the visitor's own request (the attributes not covered by the CVE-2023-5292 deny-list, which only guarded the three HTML wrapper attributes), AND a victim (e.g., a logged-in administrator) must be induced to open the attacker-crafted link or page (UI:R). Limiting factors: it is not remote-unauthenticated - it needs a contributor foothold and victim interaction, and it only affects ACF Extended / ACF Extended PRO versions 0.8.9.4 through before 0.9.2.8; sites on 0.9.2.8 or later are fixed.

This is a moderate-priority, authenticated cross-site scripting flaw (CWE-79) in the ACF Extended / ACF Extended PRO WordPress plugins, and the signals point to targeted rather than mass exploitation. The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, base 6.8) requires both privileges and victim interaction, which already caps automatability. SSVC reinforces this: Exploitation=none (no observed activity), Automatable=no (a victim must be lured into opening a crafted link), Technical Impact=total. The vuln.today decision label is 'this_month', i.e. schedule a patch, not an emergency. No KEV listing and no EPSS score were supplied, so exploitation is 'no public exploit identified at time of analysis' - the WPScan URL is an advisory reference, not confirmed working exploit code. One clear conflict must be flagged for verification: the supplied CVSS vector sets PR:H (high privileges), but the description states the flaw is reachable by 'users with a role as low as contributor,' which is a low-privilege role (PR:L) - this discrepancy understates how easily an attacker-side account can trigger it and should be confirmed with WPScan/the vendor. Net: a real issue worth patching this cycle, but the privilege requirement plus mandatory user interaction keep it below drop-everything urgency.

An attacker registers or obtains a contributor-level account on a target WordPress site and crafts a page or link using a vulnerable ACF Extended form shortcode whose attribute is pointed at a value taken from the visitor's own request, which is then reflected without escaping. When a logged-in administrator is led to open that crafted link or page, attacker-controlled JavaScript executes in the admin's browser session, enabling actions such as account or site takeover. No confirmed working exploit code is identified; only a WPScan advisory reference is provided.