{"affected":[{"defaultStatus":"unaffected","product":"Secure Custom Fields","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"6.9.8","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-97195","cwes":["CWE-79"],"description":"The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting part of it as an HTML attribute name, allowing a user able to configure its fields to store a payload that executes as JavaScript in the browser of any user who views a page rendering the affected field, which on multisite lets a site administrator who lacks the unfiltered_html capability inject script into other users' sessions.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/a2fb296c-e7f4-4a40-b503-aa709c7b88bb/"}],"kev":null,"metrics":[],"modifiedAt":1794117628542,"publishedAt":1794117628542,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/a2fb296c-e7f4-4a40-b503-aa709c7b88bb/"}],"remediation":[],"revision":"e6776d80c80d6c3fcb12c1ab345160e90ec0d1999a03a9e986ad11e8b8ee94f6","sources":[{"modifiedAt":1794117628542,"name":"CNA: WPScan","retrievedAt":1794118125941,"url":"https://www.cve.org/CVERecord?id=CVE-2026-97195"}],"ssvc":null,"status":"published","title":"Secure Custom Fields < 6.9.8 - Admin+ Stored XSS via HTML Attribute Name Injection into Field Definition","updatedAt":1794118125941}