CVE-2026-15262

Received Received - Intake

Stored XSS in Admin Columns for ACF Fields WordPress Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-03

Assigner: WPScan

Description

The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of higher-privileged users who view the affected post-list screen.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-01

Last Modified

2026-08-03

Generated

2026-08-21

AI Q&A

2026-08-01

EPSS Evaluated

2026-08-20

NVD

CVE-2026-15262

EUVD

EUVD-2026-51716

Affected Vendors & Products

Vendor	Product	Version / Range
admin_columns	acf_fields	to 0.3.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Admin Columns for ACF Fields WordPress plugin version 0.3.2 or earlier. It fails to properly escape Advanced Custom Fields values when displaying them in WordPress admin list-table columns. This allows users with contributor-level access or higher to inject malicious JavaScript payloads that execute when higher-privileged users view the affected post-list screen.

Detection Guidance

Check WordPress admin columns for unexpected JavaScript execution in post-list screens. Inspect browser console for errors when viewing affected screens. Review stored payloads in Advanced Custom Fields values for suspicious scripts.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary JavaScript code in the browser sessions of administrators or other privileged users. This could lead to session hijacking, unauthorized actions on the WordPress site, or theft of sensitive data like login credentials.

Compliance Impact

This vulnerability allows stored cross-site scripting (XSS) via unescaped Advanced Custom Fields values, which could expose sensitive user data in admin interfaces. This may violate GDPR's data protection principles (integrity and confidentiality) and HIPAA's security rule for protecting electronic protected health information (ePHI) if exploited.

Mitigation Strategies

Update the Admin Columns for ACF Fields plugin to the latest version. Disable the plugin if updates are unavailable. Restrict contributor-level access to trusted users only. Monitor admin screens for unusual activity.

Hi! I’m here to help you understand CVE-2026-15262. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70