JavaScript Injection Vulnerability in Secure Custom Fields Plugin for WordPress
CVE-2026-97195
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 8 November 2026
Badges
What is CVE-2026-97195?
The Secure Custom Fields plugin for WordPress prior to version 6.9.8 is vulnerable to JavaScript injection attacks. This vulnerability arises from the failure to properly sanitize persisted field definitions, allowing users with configuration permissions to inject malicious scripts as HTML attribute names. Consequently, when any user views a page displaying the affected fields, their browser executes the injected payload. This is particularly concerning in multisite setups where a site administrator without 'unfiltered_html' capabilities can exploit this flaw to manipulate other users' sessions, leading to unauthorized actions or data breaches. Mitigating this vulnerability comes down to updating the plugin to the latest version and ensuring that input validation is rigorously enforced.
Affected Version(s)
Secure Custom Fields 0 < 6.9.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.