JavaScript Execution Vulnerability in Admin Columns for ACF Fields WordPress Plugin
CVE-2026-15262
Currently unrated
What is CVE-2026-15262?
The Admin Columns for ACF Fields plugin for WordPress allows attackers with contributor-level access or higher to inject malicious JavaScript payloads. This vulnerability arises because the plugin fails to properly escape values from Advanced Custom Fields before rendering them in the WordPress admin list-table columns. This can lead to the execution of JavaScript in the browsers of users with higher privileges, compromising the security of the administration area.
Affected Version(s)
Admin Columns for ACF Fields 0 <= 0.3.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.