{"id":"CVE-2026-97195","kind":"vulnerability","aliases":["CVE-2026-97195"],"related":[],"title":"Secure Custom Fields WordPress plugin: stored script injection via field definitions","description":"The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting part of it as an HTML attribute name, allowing a user able to configure its fields to store a payload that executes as JavaScript in the browser of any user who views a page rendering the affected field, which on multisite lets a site administrator who lacks the unfiltered_html capability inject script into other users' sessions.","summary":"The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a saved field definition before printing part of it as an HTML attribute name. A user who can configure fields can store a script that runs in the browser of anyone who views a page showing that field, which on multisite lets a site administrator without unfiltered_html inject script into other users' sessions.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multisite","package","secure-custom-fields","wordpress"],"not_affected_if":["no-field-editing-users","plugin-version-6.9.8-or-later"],"how_to_check":"- Check the installed Secure Custom Fields version in the WordPress plugins screen or `wp plugin get secure-custom-fields --field=version`\n- On multisite, list which sites have field-definition editing rights for administrators without unfiltered_html","fix":"- Secure Custom Fields: `6.9.8` or later (per the advisory's 'before 6.9.8')","status":"open","published_at":"2026-11-08T06:17:06+00:00","first_seen_at":"2026-11-08T06:46:22+00:00","triaged_at":"2026-11-08T06:47:10+00:00","updated_at":"2026-11-08T06:47:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T06:47:10Z","model":"claude-haiku-5-5","output":{"fix":"- Secure Custom Fields: `6.9.8` or later (per the advisory's 'before 6.9.8')","reach":"internet","title":"Secure Custom Fields WordPress plugin: stored script injection via field definitions","impact":"medium","summary":"The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a saved field definition before printing part of it as an HTML attribute name. A user who can configure fields can store a script that runs in the browser of anyone who views a page showing that field, which on multisite lets a site administrator without unfiltered_html inject script into other users' sessions.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","secure-custom-fields","multisite"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker script runs in other users' browser sessions on the site","analyst_note":"","how_to_check":"- Check the installed Secure Custom Fields version in the WordPress plugins screen or `wp plugin get secure-custom-fields --field=version`\n- On multisite, list which sites have field-definition editing rights for administrators without unfiltered_html","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-version-6.9.8-or-later","no-field-editing-users"],"who_is_affected":"Sites running the Secure Custom Fields plugin before 6.9.8 where users can edit field definitions. The risk is highest on WordPress multisite, where a site administrator lacking unfiltered_html can inject script affecting other users. Sites without the plugin, or running 6.9.8 or later, are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000762,"input_tokens":4585,"output_tokens":607,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-97195':14A,17A '6.9.8':32B,97C 'abl':118C 'administr':80B,151C 'affect':143C 'allow':115C 'anyon':66B 'attribut':48B,113C 'browser':64B,133C 'capabl':157C 'configur':54B,120C 'custom':2A,22B,27B,92C 'cve':12A,15A 'definit':11A,39B,104C 'emit':106C 'execut':128C 'field':3A,10A,23B,28B,38B,55B,73B,93C,103C,122C,144C 'html':47B,83B,112C,156C 'inject':8A,84B,158C 'javascript':130C 'lack':153C 'let':77B,148C 'multisit':18B,76B,147C 'name':49B,114C 'packag':19B 'page':70B,140C 'part':42B,107C 'payload':126C 'persist':102C 'plugin':5A,30B,95C 'print':41B 'render':141C 'run':61B 'sanit':35B,100C 'save':37B 'script':7A,59B,85B,159C 'secur':1A,21B,26B,91C 'secure-custom-field':20B 'session':89B,163C 'show':71B 'site':79B,150C 'store':6A,57B,124C 'unfilt':82B,155C 'user':51B,88B,117C,136C,162C 'via':9A 'view':68B,138C 'without':81B 'wordpress':4A,24B,29B,94C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Secure Custom Fields plugin before 6.9.8 where users can edit field definitions. The risk is highest on WordPress multisite, where a site administrator lacking unfiltered_html can inject script affecting other users. Sites without the plugin, or running 6.9.8 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","multisite","package","securecustomfields","wordpress"],"campaign_type":null,"search_a":"'-2026':13A,16A '-97195':14A,17A 'custom':2A 'cve':12A,15A 'definit':11A 'field':3A,10A 'inject':8A 'plugin':5A 'script':7A 'secur':1A 'store':6A 'via':9A 'wordpress':4A","search_b":"'6.9.8':32B 'administr':80B 'anyon':66B 'attribut':48B 'browser':64B 'configur':54B 'custom':22B,27B 'definit':39B 'field':23B,28B,38B,55B,73B 'html':47B,83B 'inject':84B 'let':77B 'multisit':18B,76B 'name':49B 'packag':19B 'page':70B 'part':42B 'plugin':30B 'print':41B 'run':61B 'sanit':35B 'save':37B 'script':59B,85B 'secur':21B,26B 'secure-custom-field':20B 'session':89B 'show':71B 'site':79B 'store':57B 'unfilt':82B 'user':51B,88B 'view':68B 'without':81B 'wordpress':24B,29B","search_c":"'6.9.8':97C 'abl':118C 'administr':151C 'affect':143C 'allow':115C 'attribut':113C 'browser':133C 'capabl':157C 'configur':120C 'custom':92C 'definit':104C 'emit':106C 'execut':128C 'field':93C,103C,122C,144C 'html':112C,156C 'inject':158C 'javascript':130C 'lack':153C 'let':148C 'multisit':147C 'name':114C 'page':140C 'part':107C 'payload':126C 'persist':102C 'plugin':95C 'render':141C 'sanit':100C 'script':159C 'secur':91C 'session':163C 'site':150C 'store':124C 'unfilt':155C 'user':117C,136C,162C 'view':138C 'wordpress':94C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T06:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97195","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97195","severity":null,"published_at":"2026-11-08T06:17:06+00:00","modified_at":"2026-11-08T06:17:06+00:00","first_seen_at":"2026-11-08T06:46:22+00:00","fetched_at":"2026-11-08T06:46:22+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}