Security Alert Summary
The Secure Custom Fields WordPress plugin before 6.9.8 contains a stored cross-site scripting (XSS) issue. The plugin does not sanitize a persisted field definition before emitting part of it as an HTML attribute name, allowing a user who can configure fields to store a payload that will execute as JavaScript in the browser of any user who views a page rendering the affected field. In multisite environments this can allow a site administrator who lacks the unfiltered_html capability to inject script into other users\’ sessions.
CVE Details
- CVE ID:
CVE-2026-97195 - Affected plugin / component: Secure Custom Fields (WordPress plugin)
- Affected versions: Versions before 6.9.8 (as stated in the description)
- Published date: November 8, 2026 at 6:17:06 AM
- Last modified date: November 8, 2026 at 6:17:06 AM
- CVSS v3.1: Not provided in the data
- Authentication / privileges required: An authenticated user able to configure the plugin\’s fields can store the payload. On multisite, a site administrator (even without the unfiltered_html capability) can inject script into other users\’ sessions, per the description.
- User interaction: The victim must view a page rendering the affected field for the stored script to execute in their browser.
- Primary impact:
- Confidentiality: Script execution in a user\’s browser can expose session tokens and data available to client-side scripts.
- Integrity: An attacker-controlled script could modify content presented to the user or perform actions in the context of the user\’s session.
- Availability: Not indicated by the provided description; no direct availability impact is specified.
- CWE / weakness ID: Not specified in the data
Technical Details
The plugin fails to sanitize a persisted field definition before emitting part of it as an HTML attribute name. Because the unsanitized value is written into the page markup, a user who can configure the plugin\’s fields can store a payload that is later interpreted by a browser as executable JavaScript when a page renders that field. The description specifically notes that the emitted portion is used as an attribute name, and that the payload executes in the browser of any user who views a page rendering the affected field.
No specific functions, REST API endpoints, or code paths are named in the provided information. The vulnerability is a stored XSS due to insufficient input validation or output encoding for field definitions that are later emitted into HTML attribute context.
The practical impact is client-side script execution in users\’ browsers: an attacker could run JavaScript in the context of a victim user, which can lead to session token theft, actions performed as that user in the browser, or other client-side data exposure. The description also highlights an elevated risk on multisite installations where a site administrator who does not have unfiltered_html can still cause script injection affecting other users.
How This Could Impact Your Website
Consider a site with multiple users: a site owner, internal staff who manage content, and an external contractor who configures custom fields. If a user with field-configuration access stores a malicious payload in a field definition, any staff member or visitor who views a page rendering that field could have arbitrary script run in their browser. That could expose internal user email addresses or session information visible to client-side scripts, and increase the risk of targeted phishing or social engineering against staff or contractors who appear to be legitimate users.
On a multisite network, a site administrator who does not have the unfiltered_html capability could still cause script to be injected into other users\’ sessions when pages render the affected field, widening the potential impact across multiple sites.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for users who can configure custom fields.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and review plugin permissions regularly.
- Monitor site activity and logs for unusual behavior, such as unexpected changes to field definitions or content that includes unexpected markup.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
