CVE-2026-15262
Received Received - Intake

Stored XSS in Admin Columns for ACF Fields WordPress Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: WPScan

Description
The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of higher-privileged users who view the affected post-list screen.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-15262
EUVD
EUVD-2026-51716

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
admin_columns acf_fields to 0.3.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Admin Columns for ACF Fields WordPress plugin version 0.3.2 or earlier. It fails to properly escape Advanced Custom Fields values when displaying them in WordPress admin list-table columns. This allows users with contributor-level access or higher to inject malicious JavaScript payloads that execute when higher-privileged users view the affected post-list screen.

Detection Guidance

Check WordPress admin columns for unexpected JavaScript execution in post-list screens. Inspect browser console for errors when viewing affected screens. Review stored payloads in Advanced Custom Fields values for suspicious scripts.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary JavaScript code in the browser sessions of administrators or other privileged users. This could lead to session hijacking, unauthorized actions on the WordPress site, or theft of sensitive data like login credentials.

Compliance Impact

This vulnerability allows stored cross-site scripting (XSS) via unescaped Advanced Custom Fields values, which could expose sensitive user data in admin interfaces. This may violate GDPR's data protection principles (integrity and confidentiality) and HIPAA's security rule for protecting electronic protected health information (ePHI) if exploited.

Mitigation Strategies

Update the Admin Columns for ACF Fields plugin to the latest version. Disable the plugin if updates are unavailable. Restrict contributor-level access to trusted users only. Monitor admin screens for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15262. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart