CVE-2026-97195
The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting part of it as an HTML attribute name, all…
Impact
The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting part of it as an HTML attribute name, allowing a user able to configure its fields to store a payload that executes as JavaScript in the browser of any user who views a page rendering the affected field, which on multisite lets a site administrator who lacks the unfiltered_html capability inject script into other users' sessions.
An attacker can exploit this over the network, with an administrator account, but a user has to do something, such as open a file or a link. If it succeeds: low risk of data being read, low risk of data or systems being changed.
Affected products · Unknown
| Product | Affected versions |
|---|---|
| Secure Custom Fields | before 6.9.8 |