---
schema_version: "1"
id: ef90f357b08a1f3fc3cc107e9e6017da73c8d1ee09452e7b3b82ea0323c9bc1f
title: Visualforce
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/260-0-0/rn_vf.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_vf.htm&release=260&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 3a5908687a3e499e1cf0a7c7c070b16b8db3a1d7c1c9762bec60153ddd45dbe7
description: Visualforce contains a release update in Spring ’26, a continuation of an earlier release update.
products:
  - Cross Cloud Packages Solutions
release: "260"
---
# Visualforce

Visualforce contains a release update in Spring ’26, a continuation of an earlier release update.

For more information on features affected by these changes, refer to the [Visualforce Developer Guide](https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/).

- **[Escape the Label Attribute of <apex:inputField> Elements to Prevent Cross-Site Scripting in Visualforce Pages (Release Update)](https://help.salesforce.com/s/articleView?id=release-notes.rn_vf_escape_apex_inputfield_label_ru.htm&release=260&type=5)**  
    To prevent malicious code from executing in cross-site scripting (XSS) attacks on your Visualforce pages, this release update escapes the label attribute of your `<apex:inputField>` tags. This update was first available in Winter ’23.