Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.9.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-12 | 1 | Disclosure1 |
| 2026-05-13 | 1 | General1 |
CVE-2025-15463 Arbitrary Shortcode Execution in Advanced Custom Fields https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-15463 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The text announces CVE‑2025‑15463 but provides only its name and a link, lacking detailed technical data or exploitation evidence.
CVE-2025-15463 The The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.9.2.3. This is du… https://www.cve.org/CVERecord?id=CVE-2025-15463
Post summary
The tweet announces CVE-2025-15463, highlighting that Advanced Custom Fields: Extended plugin for WordPress is vulnerable to arbitrary shortcode execution in versions up to 0.9.2.3, without mentioning PoC code, exploits, or patches.