CVE-2026-2594mediumCWE-79

CVE-2026-2594: falha de média gravidade em inc2734 Smart Custom Fields

Smart Custom Fields <= 5.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title

Publicada em

Seguir esta CVE+ Monitorar Smart Custom Fields

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.4epss 0.3%
The Smart Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.7. This is due to insufficient input sanitization and output escaping of uploaded image attachment titles. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially patched in 5.0.7.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Produtos afetados
inc2734 · Smart Custom Fields
CVEs relacionadas — inc2734 Smart Custom Fields

No mesmo produto, das mais perigosas para as menos.

CVE-2024-1995MEDIUMSmart Custom Fields <= 4.2.2 - Missing Authorization to Authenticated (Subscriber+) Post Content DisclosureEPSS 0.6%CVE-2026-4066MEDIUMSmart Custom Fields <= 5.0.6 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post SearchEPSS 0.3%