CVE-2026-15262: Admin Columns ACF Fields XSS Vulnerability

CVE-2026-15262 Overview

CVE-2026-15262 is a stored Cross-Site Scripting (XSS) vulnerability in the Admin Columns for ACF Fields WordPress plugin through version 0.3.2. The plugin fails to escape Advanced Custom Fields (ACF) values before rendering them in WordPress admin list-table columns. Contributor-level users can inject JavaScript payloads that execute when higher-privileged users view affected post-list screens. The vulnerability is tracked under CWE-79 and requires low privileges plus user interaction to exploit.

Critical Impact
Contributor accounts can store JavaScript that executes in editor and administrator browser sessions, enabling session theft, forced administrative actions, and privilege escalation via the WordPress admin interface.

Affected Products

Admin Columns for ACF Fields WordPress plugin, all versions through 0.3.2
WordPress installations exposing ACF-managed post types to contributor-level users
Sites relying on the plugin's list-table columns to display ACF field values

Discovery Timeline

2026-08-01 - CVE-2026-15262 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-15262

Vulnerability Analysis

The Admin Columns for ACF Fields plugin extends the WordPress admin list-table with custom columns that display Advanced Custom Fields values. When rendering column output, the plugin writes ACF field content directly into the HTML document without applying WordPress escaping functions such as esc_html() or esc_attr().

Any user permitted to edit ACF fields on a post, including contributors, can store arbitrary HTML and JavaScript in those fields. When an editor or administrator loads the corresponding post-list screen, the browser parses the injected markup and executes attacker-controlled script in the authenticated admin session.

Because the payload executes in a privileged context, an attacker can issue authenticated requests to WordPress REST endpoints, create new administrator accounts, modify plugin or theme files, or exfiltrate nonces used for CSRF-protected actions.

Root Cause

The root cause is missing output encoding on user-supplied ACF field values before they are echoed into the admin list-table HTML. The plugin trusts field content stored by lower-privileged users and outputs it verbatim, violating the WordPress guidance to escape late and escape often.

Attack Vector

Exploitation is network-based and requires an authenticated contributor account plus user interaction from a higher-privileged victim. The attacker edits a post and stores a script payload in an ACF field configured to appear as an admin column. When an editor or administrator visits the post-list screen for that post type, the payload executes in their browser. The scope change reflects that a lower-privileged user impacts the session of higher-privileged users.

No public proof-of-concept code is currently linked in the referenced advisory. See the WPScan advisory for technical details.

Detection Methods for CVE-2026-15262

Indicators of Compromise

ACF field values containing <script> tags, on*= event handlers, or javascript: URIs stored by contributor-level accounts
Unexpected creation of administrator users or modification of user roles shortly after admin list-table access
Outbound requests from admin browsers to unfamiliar domains following visits to post-list screens
Anomalous authenticated calls to /wp-json/wp/v2/users or /wp-admin/admin-ajax.php originating from editor or administrator sessions

Detection Strategies

Query the wp_postmeta table for ACF meta values matching common XSS signatures such as <script, onerror=, or onload=
Review WordPress audit logs for contributor accounts editing ACF fields immediately before administrator session anomalies
Inspect web server access logs for admin list-table URLs (edit.php?post_type=...) followed by unusual REST or AJAX activity from the same session

Monitoring Recommendations

Enable a WordPress activity logging plugin to record post edits, user role changes, and plugin file modifications
Alert on new administrator account creation events, especially outside normal change windows
Monitor for plugin installations, theme edits, or option changes triggered from editor or administrator sessions after list-table page loads

How to Mitigate CVE-2026-15262

Immediate Actions Required

Deactivate the Admin Columns for ACF Fields plugin until a patched release is available, given that all versions through 0.3.2 are affected
Audit ACF field content for stored HTML or JavaScript and sanitize suspicious values before re-enabling the plugin
Review contributor-level accounts and remove or restrict any that are not strictly required
Rotate administrator passwords and invalidate active sessions if list-table screens have been visited since untrusted contributor edits

Patch Information

At the time of publication, the referenced WPScan advisory lists the plugin as vulnerable through version 0.3.2 without a fixed release identified. Monitor the plugin's WordPress.org page and the WPScan advisory for a patched version, and apply it immediately once released.

Workarounds

Remove or hide plugin-provided ACF columns from admin list-table screens to prevent unsanitized output from rendering
Restrict ACF field editing to editor-level accounts or above using capability management until the plugin is patched
Deploy a Web Application Firewall (WAF) rule that inspects and blocks HTML or script markup submitted to ACF field endpoints
Enforce a strict Content Security Policy (CSP) on /wp-admin/ responses to limit inline script execution

bash

# Example: disable the plugin via WP-CLI until a patch is available
wp plugin deactivate admin-columns-for-acf-fields

# Search postmeta for suspicious ACF values containing script tags
wp db query "SELECT post_id, meta_key, LEFT(meta_value,120) AS preview \
  FROM wp_postmeta \
  WHERE meta_value LIKE '%<script%' \
     OR meta_value LIKE '%onerror=%' \
     OR meta_value LIKE '%onload=%';"