Admin Columns for ACF Fields <= 0.3.2 – Contributor+ Stored XSS via ACF Field Value Column | CVE 2026-15262

Description

The plugin does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of higher-privileged users who view the affected post-list screen.

Proof of Concept

Prerequisites:
- Advanced Custom Fields (free) and Admin Columns for ACF Fields 0.3.2 active.
- (Administrator, one-time) Under Custom Fields > Add New, create a field group located on "Post" with a Color Picker field (field name: hue), and enable its "Admin Column" toggle (added by this plugin). Publish the field group.

Note on the vector: a Contributor lacks unfiltered_html, so ACF core runs wp_kses_post on saved field values, which strips content-context tags such as <script>. The working payload therefore breaks out of an HTML attribute (no "<" needed), using a field type whose value the plugin renders into an attribute. The Color Picker field is the clear case (its value is concatenated into a style="..." attribute).

1. As a Contributor (edit_posts, no unfiltered_html), add a new post and set the Color Picker field value to exactly:

   red" onmouseover="alert(document.domain)

   Submit for review. The value contains no "<" characters, so ACF core's save-side wp_kses_post leaves it intact.

2. As an Editor or Administrator (the victim), open the Posts list:

   /wp-admin/edit.php?post_type=post

   The plugin renders the stored value unescaped into a style attribute in the column cell, producing:

   <div style="display:inline-block;height:20px;width:100%;background-color:red" onmouseover="alert(document.domain);white-space:nowrap;">red" onmouseover="alert(document.domain)</div>

   The closing double-quote after "red" terminates the style attribute and injects a live onmouseover handler on the <div>, which executes in the victim's authenticated session when they hover the cell.