CVE-2026-97195: Secure Custom Fields < 6.9.8 - Admin+ Stored XSS via HTML Attribute Name Injection into Field Definition

Q: Who can exploit this issue?

An attacker must be able to configure Secure Custom Fields fields and save a malicious field definition. In a WordPress multisite deployment, a site administrator without the unfiltered_html capability can use this to inject script into sessions of users who view a page rendering the affected field.

Q: When does the stored payload execute?

The payload executes in the browser when a user views a page that renders the affected field. The vulnerable behavior involves persisted field definitions being emitted as HTML attribute names.

Q: Which versions are affected?

Secure Custom Fields versions before 6.9.8 are affected. Updating to version 6.9.8 or later addresses the described vulnerable version range.

Published Nov 8, 2026

Updated

The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting part of it as an HTML attribute name, allowing a user able to configure its fields to store a payload that executes as JavaScript in the browser of any user who views a page rendering the affected field, which on multisite lets a site administrator who lacks the unfilteredhtml capability inject script into other users' sessions.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Secure Custom Fields to a version that resolves this vulnerability.
Fixed in 6.9.8

Event History

Nov 8, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

An attacker must be able to configure Secure Custom Fields fields and save a malicious field definition. In a WordPress multisite deployment, a site administrator without the unfiltered_html capability can use this to inject script into sessions of users who view a page rendering the affected field.

When does the stored payload execute?

The payload executes in the browser when a user views a page that renders the affected field. The vulnerable behavior involves persisted field definitions being emitted as HTML attribute names.

Which versions are affected?

Secure Custom Fields versions before 6.9.8 are affected. Updating to version 6.9.8 or later addresses the described vulnerable version range.

CVE-2026-97195: Secure Custom Fields < 6.9.8 - Admin+ Stored XSS via HTML Attribute Name Injection into Field Definition

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

When does the stored payload execute?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

When does the stored payload execute?

Which versions are affected?