EUVD-2026-45122
GHSA-xpfv-qr3c-jw2p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
UI:R applied because stored XSS impact requires victim page navigation; PR:L reflects mandatory Author-level authentication; S:C for cross-browser scope change.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Smart Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.7. This is due to insufficient input sanitization and output escaping of uploaded image attachment titles. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially patched in 5.0.7.
AnalysisAI
Stored cross-site scripting in the Smart Custom Fields WordPress plugin (versions up to and including 5.0.7) enables authenticated attackers holding at minimum Author-level access to persist malicious JavaScript payloads by supplying unsanitized content in uploaded image attachment titles. Any site visitor who subsequently loads an affected page triggers execution of the injected script within their browser, enabling session hijacking, credential harvesting, or unauthorized actions on behalf of that user. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis; however, the vulnerability is partially unresolved even in the stated boundary version 5.0.7, making the precise remediation target unclear without consulting the referenced patch changesets.
Technical ContextAI
The affected component is the Smart Custom Fields plugin (CPE: cpe:2.3:a:inc2734:smart_custom_fields:*:*:*:*:*:*:*:*), a WordPress plugin by inc2734 that provides customizable meta field management for posts and pages. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a failure to sanitize and escape image attachment titles before they are stored in the WordPress database and later rendered in page output. Because the injected data persists server-side and is emitted to every subsequent visitor without escaping, this is a Stored (Persistent) XSS variant - more impactful than Reflected XSS because a single injection can affect many victims. The vulnerability sits in the file upload and attachment handling path of the plugin, not the core WordPress media library.
RemediationAI
The primary remediation path is to update to the version of Smart Custom Fields that incorporates the complete fix referenced in the WordPress plugin repository changesets 3485210 (https://plugins.trac.wordpress.org/changeset/3485210/smart-custom-fields) and 3609564 (https://plugins.trac.wordpress.org/changeset/3609564/smart-custom-fields). Because version 5.0.7 is explicitly described as only partially patched, administrators should verify via the WordPress plugin admin dashboard or the plugin's changelog that their installed version post-dates both referenced changesets. An exact fully-remediated release version was not independently confirmed from the available source data - confirm the target version with the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/110a1b28-50e0-430e-82d4-c254d73836e2 before updating. As a compensating control where immediate patching is not possible, restricting the Author role from uploading media attachments (via a role management plugin such as Members or User Role Editor) eliminates the primary attack vector, though this may disrupt editorial workflows. Alternatively, a Web Application Firewall rule blocking stored XSS payloads in attachment title fields can provide partial mitigation, though WAF bypass techniques exist.
More in Smart Custom Fields
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today