CVE-2026-15262

Name of the Vulnerable Software and Affected Versions Admin Columns for ACF Fields versions prior to 0.3.3

Description The plugin fails to escape Advanced Custom Fields values before they are displayed in the WordPress admin list-table columns. This allows users with contributor-level access or higher to store a malicious payload that executes as JavaScript in the session of higher-privileged users when they view the affected post-list screen. This is a stored Cross-Site Scripting (XSS) issue, where a script is permanently stored on the server and executed in the browser of another user.

Recommendations Update Admin Columns for ACF Fields to version 0.3.3 or later.