Executive brief
A vulnerability in the Admin Columns for ACF Fields WordPress plugin allows lower-privileged users, such as contributors, to inject malicious scripts into the administrative dashboard. When a site administrator or editor views the list of posts, these scripts can execute in their browser session. This could lead to unauthorized actions being performed on behalf of the administrator, potentially resulting in a full site takeover.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw located in how the plugin renders Advanced Custom Fields (ACF) values within the WordPress admin post-list screen. Specifically, the plugin fails to escape field values before outputting them into HTML attributes (such as the 'style' attribute for Color Picker fields). An attacker with Contributor-level privileges can bypass standard WordPress 'unfiltered_html' restrictions by providing a payload that does not use script tags but instead uses attribute-breaking characters (e.g., double quotes) to inject event handlers like 'onmouseover'. When a higher-privileged user views the affected admin page, the injected JavaScript executes in their context. As of the advisory date, there is no known fix available.
Affected products
- Unknown Admin Columns for ACF Fields <= 0.3.2
Timeline
- 2026-07-10: other: Vulnerability added to WPScan database
- 2026-07-17: disclosed: Publicly published by WPScan
- 2026-08-01: advisory: NVD published date