CVE-2026-94263

MediumCVSS 4.8/10Last modified Oct 23, 2026

Description

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published
Oct 23, 2026
Last modified
Oct 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-942646.8The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 dCVE-2026-94265When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmCVE-2026-94266libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neitCVE-2026-942679.0The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 dCVE-2026-942688.1The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 dCVE-2026-942696.3Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In some configurations where a permissive routCVE-2026-94278.8A flaw has been found in Edimax EW-7438RPn 1.31. This impacts the function formWlSiteSurvey of the file /goform/formWlSiteSurvey of the compCVE-2026-942705.3The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and shCVE-2026-942715.3The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return fromCVE-2026-942725.3The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorisCVE-2026-942735.3The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approveCVE-2026-942745.3The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, incl
CVE-2026-94263: Medium severity, CVSS 4.8 | Vulnix