Security releases
Researcher credits in vendor advisories
Vendors name researchers in their own advisories. Find your line and claim it. It counts on your profile right away and gets a BugRater ID you can quote.
Vendor
-
Secure Custom Fields CVE-2026-97195
The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting part of it as an HTML attribute name, allo
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Secure Custom Fields CVE-2026-97194
The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields,
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Secure Custom Fields CVE-2026-97193
The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object before writing to it during bidirectiona
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Secure Custom Fields CVE-2026-97192
The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting values submitted through the post editor
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit