CVE-2026-97195

The Secure Custom Fields WordPress plugin (versions before 6.9.8 ) is vulnerable to a Stored XSS attack due to insufficient sanitization of a persisted field definition. An attacker with the ability to configure fields can store a payload that is emitted as an HTML attribute name , leading to Jav...