CVE-2026-15262
Fresh CVE, no PoC/KEV/patch; translation-heavy blogs suggest rehashing NVD data.
What: Stored XSS in Admin Columns for ACF Fields WordPress plugin (≤0.3.2) allowing contributor-level users to inject JavaScript executed in admin sessions of higher-privileged users.
Why it matters: Same-day CVE publication with no CVSS/EPSS assigned and not yet KEV-listed. Social chatter is non-English (Hebrew, Russian) security blogs republishing the vulnerability description with alarmist framing ("serious," "hackers exploiting"). No PoC, no evidence of in-the-wild exploitation, no vendor patch advisory visible yet.
Where it's seen: Low-engagement posts on Bluesky from non-mainstream security blogs; appears to be automated or translated advisory syndication rather than organic exploit discussion or defender triage.
RISK: MODERATE — Requires contributor access; affects admin surfaces only; no active exploitation confirmed.
Description
The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of higher-privileged users who view the affected post-list screen.