# CVE-2026-94264: Advanced Custom Fields: Extended XSS in form shortcode attributes

Source: https://junglewise.ai/threats/cve-2026-94264-the-advanced-custom-fields-extended-wordpress-plugin-before-0-9-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-94264 · Severity: info · Published 2026-10-23

The Advanced Custom Fields: Extended WordPress plugin allows users with the contributor role or higher to inject malicious scripts that execute in the browsers of site visitors, including administrators. An attacker can craft a malicious link that, when clicked, runs arbitrary JavaScript in the victim's browser, potentially stealing session cookies or performing unauthorized actions.

Technologies: [Delicious Brains Advanced Custom Fields: Extended](https://junglewise.ai/threats/technologies/delicious-brains-advanced-custom-fields-extended), [Delicious Brains Advanced Custom Fields: Extended PRO](https://junglewise.ai/threats/technologies/advanced-custom-fields-extended-pro). Vendors: [Delicious Brains](https://junglewise.ai/threats/vendors/delicious-brains).

## Quick answers

**Is CVE-2026-94264 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94264 being exploited in the wild.

**How severe is CVE-2026-94264?** Informational severity, published 23 October 2026.

**Which products and versions are affected?** Delicious Brains Advanced Custom Fields: Extended 0.8.9.4 to 0.9.2.7; Delicious Brains Advanced Custom Fields: Extended PRO 0.8.9.4 to 0.9.2.7.

**Is there a fix for CVE-2026-94264?** Yes: fixed in Advanced Custom Fields: Extended 0.9.2.8, Advanced Custom Fields: Extended PRO 0.9.2.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-94264 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-94264?** Check whether you run Delicious Brains Advanced Custom Fields: Extended or Delicious Brains Advanced Custom Fields: Extended PRO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Advanced Custom Fields: Extended 0.9.2.8, Advanced Custom Fields: Extended PRO 0.9.2.8

## Technical details

The plugin fails to properly validate or escape form shortcode attributes, allowing request parameters to be output without sanitization. This is a bypass of an incomplete fix for CVE-2023-5292; the previous patch covered only three HTML wrapper attributes, leaving other attributes vulnerable. A contributor-level user can craft a shortcode with unescaped attributes that reflect user input, leading to stored or reflected XSS when an administrator or any site user views the affected page.

## Affected products

- Delicious Brains Advanced Custom Fields: Extended 0.8.9.4 to 0.9.2.7
- Delicious Brains Advanced Custom Fields: Extended PRO 0.8.9.4 to 0.9.2.7

## Timeline

- 2026-10-21: disclosed
- 2026-10-23: advisory

## References

- [https://wpscan.com/vulnerability/4475b8a6-0d25-49b2-b973-5e19b8958595/](https://wpscan.com/vulnerability/4475b8a6-0d25-49b2-b973-5e19b8958595/)

## Related threats

- [Advanced Custom Fields: Extended sensitive information exposure via template injection](https://junglewise.ai/threats/cve-2026-110305-the-advanced-custom-fields-extended-plugin-for-wordpress-is)
- [Advanced Custom Fields: Extended authorization bypass in AJAX handlers](https://junglewise.ai/threats/cve-2026-2839-the-advanced-custom-fields-extended-plugin-for-wordpress-is)
- [Advanced Custom Fields Extended privilege escalation in front-end Forms](https://junglewise.ai/threats/cve-2026-94268-the-advanced-custom-fields-extended-wordpress-plugin-before-0-9-2)
- [Advanced Custom Fields: Extended unauthenticated RCE in post update](https://junglewise.ai/threats/cve-2026-94267-the-advanced-custom-fields-extended-wordpress-plugin-before-0-9-2)
- [Advanced Custom Fields: Extended account takeover in user update](https://junglewise.ai/threats/cve-2026-94262-the-advanced-custom-fields-extended-wordpress-plugin-before-0-9-2)