CVE-2026-2594 describes a stored Cross-Site Scripting vulnerability in the Smart Custom Fields plugin for WordPress. The issue arises from improper neutralization of input during web page generation, specifically insufficient input sanitization and output escaping of image attachment titles uploaded by users. This allows authenticated attackers with Author-level privileges or higher to inject arbitrary web scripts that execute in the context of other users viewing the injected pages. The vulnerability is present in versions up to and including 5.0.7, where a partial patch was applied but no complete remediation level or official fix has been confirmed.

Successful exploitation allows an authenticated user with Author-level access or above to inject malicious scripts that execute in other users' browsers when they access the affected pages. This can lead to information disclosure or session hijacking limited to the scope of the plugin's usage and user privileges. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, privileges required, no user interaction, and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability was only partially patched in version 5.0.7, users should monitor for an official update that fully addresses the issue. Until a full fix is available, restrict Author-level user permissions where possible and review uploaded image attachment titles for suspicious content.