CVE-2023-5292

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acfe_form' shortcode in versions up to, and including, 0.8.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79
• CWE-79

• https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.8.9.3/includes/modules/form/module-form-front.php#L669Product
• https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.8.9.4/includes/modules/form/module-form-front.php#L669Product
• https://plugins.trac.wordpress.org/changeset/2972880/acf-extended#file4Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/dcbe0c72-d518-45d3-a220-896a51071b26?source=cveProduct, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.8.9.3/includes/modules/form/module-form-front.php#L669Product
• https://plugins.trac.wordpress.org/browser/acf-extended/tags/0.8.9.4/includes/modules/form/module-form-front.php#L669Product
• https://plugins.trac.wordpress.org/changeset/2972880/acf-extended#file4Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/dcbe0c72-d518-45d3-a220-896a51071b26?source=cveProduct, Third Party Advisory

Published

Oct 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-52914In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-52915In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-52916In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2023-52917Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2023-52918In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-52919In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-52920In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-52921In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2023-52922In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2023-52923In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-52924In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-52925In the Linux kernel, the following vulnerability has been re…5.5