CVE-2026-15262 is a Cross-Site Scripting (CWE-79) vulnerability in the Admin Columns for ACF Fields WordPress plugin versions up to 0.3.2. The plugin fails to escape Advanced Custom Fields values before outputting them in admin list-table columns, allowing users with contributor-level permissions or above to inject JavaScript payloads. These payloads execute in the session context of higher-privileged users who view the affected post list screen, potentially leading to session hijacking or other client-side attacks. The vulnerability is confirmed published with a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An attacker with contributor-level access or higher can inject malicious JavaScript into Advanced Custom Fields values that are rendered unescaped in the WordPress admin interface. When higher-privileged users (e.g., administrators) view the affected post list screen, the injected script executes in their browser session. This can lead to limited confidentiality and integrity impacts such as session hijacking or unauthorized actions performed on behalf of the privileged user. Availability is not affected. The vulnerability requires user interaction (viewing the post list) and privileges to inject the payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider monitoring or limiting the use of the affected plugin. Avoid viewing the affected post list screen with high-privileged accounts if possible. Follow vendor communications for updates on patches or official mitigations.