The plugin fails to escape Advanced Custom Fields values that are displayed in the WordPress admin list‑table columns, allowing a user with contributor‑level or higher access to store a harmless payload that is delivered as JavaScript to higher‑privileged users. If exploited, an attacker can execute arbitrary code inside the browser session of administrators or editors, potentially stealing credentials or performing other malicious actions. The weakness is a classic stored cross‑site scripting flaw, labeled CWE‑79.

Admin Columns for ACF Fields, all installations using version 0.3.2 or earlier, running on WordPress.

The EPSS score is reported as less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of exploitation in the wild. The CVSS score of 5.4 indicates moderate severity impact. However, because the attack path requires a contributor‑level user to inject the payload and a privileged user to view the affected screen, the risk is limited to sites where such roles exist. Without an official patch, the exploitation remains a theoretical risk that requires deliberate action by an attacker and an opportunity for a defender to mitigate.