CVE-2025-26746

Name of the Vulnerable Software and Affected Versions NotFound Advanced Custom Fields: Link Picker Field versions 1.2.8 and earlier

Description The issue is related to improper neutralization of input during web page generation, which allows for reflected Cross-site Scripting (XSS). This enables attackers to inject malicious scripts into websites, potentially leading to unauthorized actions or data theft. The problem affects the Link Picker Field in Advanced Custom Fields.

Recommendations For versions 1.2.8 and earlier, update to a version later than 1.2.8 to resolve the issue. As a temporary workaround, consider disabling the Link Picker Field until a patch is available. Restrict access to the Link Picker Field to minimize the risk of exploitation.