WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
custom-background-changer
Published
2025-12-31
Title
Custom Background Changer < 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
custom-banners
Published
2014-08-01
Title
Custom Banners 1.2.2.2 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
custom-banners
Published
2021-02-17
Title
Custom Banners < 3.3 - CSRF Nonce Bypass in saveCustomFields
Slug
custom-banners
Published
2024-09-30
Title
Custom Banners <= 3.3 - Reflected Cross-Site Scripting
Slug
custom-base-terms
Published
2023-05-22
Title
Custom Base Terms < 1.0.3 - Admin+ Stored XSS
Slug
custom-bulkquick-edit
Published
2025-06-05
Title
Custom Bulk/Quick Edit <= 1.6.10 - Cross-Site Request Forgery
Slug
custom-checkout-fields-for-woocommerce
Published
2025-05-07
Title
Multiple Plugins by wpcodefactory <= Various Versions - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
custom-codes
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
custom-coming-soon
Published
2025-01-16
Title
Custom Coming Soon <= 2.2 - Reflected Cross-Site Scripting
Slug
custom-comment-notifications
Published
2025-02-03
Title
Custom Comment Notifications <= 1.0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
custom-contact-forms
Published
2014-08-01
Title
Custom Contact Forms < 5.1.0.3 - Authenticated Cross Site Scripting
Slug
custom-contact-forms
Published
2014-09-17
Title
Custom Contact Forms < 5.1.0.4 - Unauthenticated Database Import/Export
Slug
custom-contact-forms
Published
2026-09-04
Title
Custom Contact Forms < 7.16.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters
Slug
custom-content-scrollbar
Published
2025-03-31
Title
Custom Content Scrollbar <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
custom-content-shortcode
Published
2022-02-02
Title
Custom Content Shortcode < 4.0.2 - Authenticated Stored Cross-Site Scripting
Slug
custom-content-shortcode
Published
2022-02-02
Title
Custom Content Shortcode < 4.0.2 - Authenticated Arbitrary File Access / LFI
Slug
custom-content-shortcode
Published
2022-02-02
Title
Custom Content Shortcode < 4.0.1 - Unauthorised Arbitrary Post Metadata Access
Slug
custom-content-shortcode
Published
2023-02-22
Title
Custom Content Shortcode <= 4.0.2 - Contributor+ Stored XSS
Slug
custom-content-shortcode
Published
2023-02-22
Title
Custom Content Shortcode <= 4.0.2 - Contributor+ LFI
Slug
custom-content-type-manager
Published
2012-06-11
Title
Custom Content Type Manager < 0.9.8.9 - Remote File Upload
Slug
custom-content-type-manager
Published
2015-05-21
Title
Custom Content Type Manager <= 0.9.8.5 - Remote Code Execution
Slug
custom-content-type-manager
Published
2016-03-07
Title
Custom Content Type Manager >= 0.9.8.8 - Multiple Vulnerabilities
Slug
custom-css
Published
2024-11-22
Title
Custom CSS, JS & PHP < 2.4.0 - Reflected Cross-Site Scripting
Slug
custom-css
Published
2025-04-16
Title
Custom CSS, JS & PHP < 2.4.2 - Cross-Site Request Forgery to Remote Code Exectuiron
Slug
custom-css-and-javascript
Published
2026-08-06
Title
Custom CSS and JavaScript <= 2.0.16 - Unauthenticated Information Exposure