CVE-2026-15262

The CVE concerns the WordPress plugin Admin Columns for ACF Fields, affected through version 0.3.2. The root cause is that Advanced Custom Fields values are not escaped before being output in the WordPress admin post-list table. This allows users with contributor-level access or higher to store a...