Description
The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Unknown Advanced Custom Fields: Extended
Default version status: unaffected
0.9.2.4 to < 0.9.2.8affected
Unknown Advanced Custom Fields: Extended PRO
Default version status: unaffected
0.9.2.4 to < 0.9.2.8affected