CVE-2026-97195

Name of the Vulnerable Software and Affected Versions Secure Custom Fields WordPress plugin versions prior to 6.9.8

Description Insufficient sanitization of a persisted field definition allows a user with field configuration privileges to store a payload that executes as JavaScript in the browser of any user viewing a page that renders the affected field. In multisite environments, this allows a site administrator without the unfiltered html capability to inject scripts into other users' sessions.

Recommendations Update the Secure Custom Fields WordPress plugin to version 6.9.8 or later.