CVE-2026-112313
HighCVSS 7.1Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended acf-extended allows Stored XSS. This issue affects ACF Extended: from n/a through 0.9.2.7.
Risk Assessment
An attacker can inject a malicious script that executes in the user's browser, which may lead to session theft, account takeover, or page content modification.
Recommendation
Update the ACF Extended plugin to a version later than 0.9.2.7 that fixes the vulnerability. Until then, implement WAF rules to block XSS attempts and monitor for unusual scripts in content.
Other vulnerabilities in ACF Extended
See all- CVE-2026-112312High
The ACF Extended WordPress plugin (versions through 0.9.2.7) contains a missing authorization vulnerability due to incorrectly configured access control security levels. This may allow exploitation of improperly configured access controls.
- CVE-2026-112311Medium
The ACF Extended plugin through 0.9.2.7 contains a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. This may allow an attacker to access files outside the intended directory.
- CVE-2026-81284Medium
The ACF Extended plugin in versions 0.9.2.6 and earlier has a Broken Access Control vulnerability for contributors. Contributor-level users can gain unauthorized access to administrative functions.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects ACF Extended: from n/a through 0.9.2.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS