Executive brief
The Smart Custom Fields plugin for WordPress, which allows site administrators to add custom data fields to their content, contains a security flaw. An attacker with basic contributor or author permissions could upload an image with a malicious title that executes harmful scripts when viewed by other users or administrators. This could lead to unauthorized actions being performed in the context of a site administrator's session.
Technical details
The Smart Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the titles of uploaded image attachments. The root cause is a failure to properly sanitize input and escape output when processing these titles. An authenticated attacker with Author-level permissions or higher can inject arbitrary web scripts into the database. These scripts will then execute in the browser of any user who accesses the page where the malicious attachment title is rendered. The vulnerability was partially addressed in version 5.0.7, but remains a risk in that and earlier versions.
Affected products
- inc2734 Smart Custom Fields up to, and including, 5.0.7
Timeline
- 2026-07-17: advisory: NVD publication date
- 2026-07-16: disclosed: Wordfence disclosure date