EUVD-2026-51716
GHSA-xvf5-2cph-6chj
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Contributor account required (PR:L), admin must view post-list (UI:R), scope changes to admin session (S:C); no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of higher-privileged users who view the affected post-list screen.
AnalysisAI
Stored cross-site scripting in Admin Columns for ACF Fields WordPress plugin (through 0.3.2) allows contributor-level users to inject unsanitized JavaScript via Advanced Custom Fields values that execute in the browser session of any higher-privileged user who views the affected post-list admin screen. The scope change (S:C in CVSS) reflects that the payload crosses privilege boundaries - a low-privileged contributor can target editors and administrators. A publicly available exploit has been published by WPScan, though EPSS at 0.15% (5th percentile) indicates limited observed exploitation in the wild, and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
The plugin (CPE: cpe:2.3:a:unknown:admin_columns_for_acf_fields:*:*:*:*:*:*:*:*) extends the WordPress admin list-table UI by rendering values from ACF (Advanced Custom Fields) directly in column cells. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation / Stored XSS): ACF field values submitted by lower-privileged users are stored in the WordPress database and subsequently rendered in the admin post-list screen without HTML entity encoding or output escaping. Because WordPress's list-table is rendered server-side and served to any admin who navigates to the post list, the payload persists and fires in each privileged user's browser session on page load - a classic stored XSS pattern that requires no real-time interaction with the attacker.
RemediationAI
No vendor-released patched version has been identified at time of analysis - the advisory covers all versions through 0.3.2 with no confirmed fix release. Site administrators should check the WordPress plugin repository or the WPScan advisory (https://wpscan.com/vulnerability/dea1f3a9-2681-47a6-9e36-9d6ea799decb/) for an updated release. If no patch is available, the primary compensating control is to deactivate and remove the Admin Columns for ACF Fields plugin until a fixed version is released; this eliminates the attack surface entirely at the cost of losing ACF-column visibility in admin list views. If the plugin must remain active, restrict WordPress contributor role assignments to only fully trusted internal users, since untrusted contributor accounts are the direct prerequisite for exploitation. Additionally, implementing a Content Security Policy (CSP) header that restricts script execution sources can reduce XSS impact, though CSP configuration in WordPress requires careful testing to avoid breaking admin functionality.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today