CVE-2026-97195

{
  "etk_id": "ETK-2026-3890",
  "cve_id": "CVE-2026-97195",
  "display_id": "CVE-2026-97195",
  "ghsa_id": "GHSA-47pm-jg2m-gx97",
  "euvd_id": "EUVD-2026-119464",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in Secure Custom Fields",
  "summary": "Secure Custom Fields versions before 6.9.8 can render unsafe field-definition content in page markup. An attacker who can configure fields may cause script to run in the browser of users viewing pages that render the affected field, including across users in a multisite installation.",
  "mitigation": "Upgrade Secure Custom Fields to version 6.9.8 or later. Until upgraded, restrict field-configuration privileges to trusted users and review existing field definitions.",
  "vendor": null,
  "product": "Secure Custom Fields",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 6.9.8"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "6.9.8"
      ],
      "package_name": "Secure Custom Fields",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 38.2123332,
  "t0_at": "2026-11-08T06:00:28.542000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-08T09:02:31.443160+00:00",
      "days": 0.12642246712962962,
      "is_lower_bound": false,
      "measured_at": "2026-11-08T06:00:28.542000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-08T06:00:28.542000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-08T06:00:28.542000+00:00",
      "url": "https://github.com/advisories/GHSA-47pm-jg2m-gx97"
    }
  }
}