CVE-2026-112313: WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects ACF Extended: from n/a through 0.9.2.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress ACF Extended pluginto a version that resolves this vulnerability.Fixed in 0.9.2.8
Event History
Frequently Asked Questions
Which versions are affected?
ACF Extended versions through 0.9.2.7 are affected. The available information does not identify a fixed version.
Can this be exploited remotely without an account?
The vector is network-accessible and the listed privileges requirement is none, so the available scoring indicates an attacker does not need prior privileges. Exploitation does require user interaction.
What impact can successful exploitation have?
This is a stored XSS issue with low confidentiality, integrity, and availability impact in the supplied severity vector. The scope is listed as changed, meaning the impact may extend beyond the vulnerable component's security authority.