# CVE-2026-97195: Secure Custom Fields WordPress plugin stored XSS in field definitions

Source: https://junglewise.ai/threats/cve-2026-97195-the-secure-custom-fields-wordpress-plugin-before-6-9-8-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-97195 · Severity: info · Published 2026-11-08

The Secure Custom Fields WordPress plugin allows administrators to create custom form fields. Before version 6.9.8, the plugin failed to sanitize field definitions before rendering them as HTML attributes, allowing an admin to inject JavaScript payloads that execute in the browsers of all users viewing pages with those fields. On WordPress multisite installations, this lets site admins with limited permissions compromise other users' accounts.

Technologies: [Secure Custom Fields](https://junglewise.ai/threats/technologies/secure-custom-fields). Vendors: [Secure Custom Fields](https://junglewise.ai/threats/vendors/secure-custom-fields).

## Quick answers

**Is CVE-2026-97195 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97195 being exploited in the wild.

**How severe is CVE-2026-97195?** Informational severity, published 8 November 2026.

**Which products and versions are affected?** Secure Custom Fields before 6.9.8.

**Is there a fix for CVE-2026-97195?** Yes: fixed in 6.9.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97195 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-97195?** Check whether you run Secure Custom Fields at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.9.8

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the field definition handling. An authenticated user with field configuration privileges can inject malicious JavaScript into a persisted field definition; when that field is rendered on a page, the unsanitized definition is emitted as an HTML attribute name, causing the payload to execute in visitors' browsers. A fix exists in version 6.9.8.

## Affected products

- Secure Custom Fields Secure Custom Fields before 6.9.8

## Timeline

- 2026-11-05: disclosed
- 2026-11-08: advisory

## References

- [https://wpscan.com/vulnerability/a2fb296c-e7f4-4a40-b503-aa709c7b88bb/](https://wpscan.com/vulnerability/a2fb296c-e7f4-4a40-b503-aa709c7b88bb/)

## Related threats

- [Secure Custom Fields WordPress plugin permission check bypass in relational fields](https://junglewise.ai/threats/cve-2026-97194-the-secure-custom-fields-wordpress-plugin-before-6-9-8-does-not)
- [Secure Custom Fields authorization bypass in post editor](https://junglewise.ai/threats/cve-2026-97192-the-secure-custom-fields-wordpress-plugin-before-6-9-8-does-not)