CVE-2025-26746 describes a reflected XSS vulnerability in the caalami Advanced Custom Fields: Link Picker Field plugin (versions <= 1.2.8). The issue is caused by improper input neutralization during web page generation, enabling attackers to inject and execute arbitrary scripts via crafted input. The CVSS v3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at a low level.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure, manipulation of web content, or disruption of service. The CVSS score reflects partial impacts on confidentiality, integrity, and availability. However, no known active exploitation has been reported.

No official patch or remediation guidance is currently available for this vulnerability. Users should monitor the vendor's advisories for updates and apply any forthcoming patches promptly. Until a fix is released, consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts specific to this plugin's behavior.