CVE-2026-15262 is a stored XSS in the Admin Columns for ACF Fields plugin affecting versions prior to a fix that was released. The plugin pulls ACF field values and displays them in WordPress admin list-table columns—but it outputs those values without contextual escaping for HTML attribute contexts. If a contributor-level user creates a post with a malicious payload in an ACF field (a text field, for example), that payload executes in the browser of any admin who views the posts list. This is privilege escalation: the attacker plants, the victim detonates.
The technical failure is straightforward. The developer used ACF's getter functions (get_field, etc.) to retrieve data and echo'd it directly into admin column cells. Those functions return raw field values—they're designed for content rendering contexts where you'd use the_content or the_field. List-table columns are a different context requiring esc_attr() or equivalent attribute-safe encoding. This is not an exotic mistake; it's the same pattern that produces stored XSS across dozens of WordPress plugins whenever code bridges ACF (or WooCommerce, Gravity Forms) into admin UI contexts. Developers inherit a trust assumption from the upstream library—ACF feels production-ready, so the data feels production-ready. That assumption is wrong for attribute contexts.
The severity reality exceeds the CVSS 5.4 rating. The base score treats this as generic XSS, but admin-context stored XSS has a different blast geometry: the payload executes in an authenticated admin session with access to plugin installation, theme editing, and wp-config extraction. Compromising a WordPress admin is a short path to server-level compromise. The EPSS score of 0.00133 reflects low automated exploitation likelihood, not low impact.
Remediation: verify your installation is updated to the patched version. If you're running this plugin and can't update, treat it as a high-priority removal—the plugin has been unmaintained, and abandoned WordPress plugins become permanent exposure windows with no prospect of future security fixes. Audit any custom code that displays ACF values in admin columns, admin screens, or anywhere outside the main post content loop. Always escape for the specific context: esc_attr() for HTML attributes, esc_html() for text content, wp_strip_all_tags() as a fallback when markup isn't needed. The context determines the function; ACF doesn't know your context, so you must own it.