What’s Vulnerable › Vulnerabilities
CVE-2026-15262: Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-01 · updated 2026-08-26
- Weakness: CWE-79
Description
The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of higher-privileged users who view the affected post-list screen.
Affected products
- Admin Columns for ACF Fields: through 0.3.2
References
Get alerted when CVE-2026-15262 or the next vulnerability affects your stack