The Advanced Custom Fields: Extended WordPress plugin before version 0.9.2.8 and its PRO variant before that release do not validate or escape certain form shortcode attributes. Attackers can supply values derived from the visitor’s request that are then echoed directly into the page without sanitization, enabling arbitrary JavaScript to execute in the browser of anyone who opens a link or page containing the malicious shortcode. This flaw permits cross‑site scripting from even contributors and can compromise session state, deface content, or facilitate phishing against site users. This vulnerability is a CWE‑79 (Cross‑Site Scripting) flaw.

Any WordPress installation running Advanced Custom Fields: Extended or Advanced Custom Fields: Extended PRO plugins with a version older than 0.9.2.8 is affected. The flaw exists in both the free and PRO variants and can be triggered by any visitor who views a page with a crafted shortcode attribute. Installed instances of these plugins on any WordPress site are at risk until updated to 0.9.2.8 or later.

The CVSS score of 6.8 indicates medium severity, and the vulnerability is not listed in the CISA KEV catalog. No EPSS score is available, so exploitation likelihood in the wild is unclear. Based on the description, the likely attack vector is remote: an attacker publishes a malicious link or page containing a tailored shortcode, and any user—whether anonymous, contributor, or administrator—who opens that link will have the script executed. Because the script runs in the context of the victim’s browser, attackers could hijack sessions, deface the site, or launch phishing attacks. Site owners should treat this as a high‑risk issue until a patch is applied.