CVE-2026-15262CWE-79cross-site-scripting

CVE-2026-15262

Medium · published August 1, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
12.6
In the wild
Unconfirmed
What it is

The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of higher-privileged users who view the affected post-list screen.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00226 · 12.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-01T11:16Z
References (1)
https://wpscan.com/vulnerability/dea1f3a9-2681-47a6-9e36-9d6ea799decb/ · [email protected]
EPSS history
Timeline
  • 01 AUG 06:00Z
    Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column
    cvelistv5