Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows… (CVE-2026-112313)

The ACF Extended plugin for WordPress versions through 0.9.2.7 is affected by a stored cross-site scripting (XSS) vulnerability (CWE-79) caused by improper input neutralization during web page generation. This vulnerability enables attackers to inject malicious scripts that persist on the affected site and execute in users' browsers, potentially leading to confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of users visiting the affected site, potentially resulting in data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The vulnerability affects all users who interact with the maliciously crafted content stored by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying input validation or output encoding workarounds if feasible. Monitor vendor channels for updates and apply patches promptly once released.