1034 matches found
CVE-2025-23822
CVE-2025-23822 is a CSRF vulnerability in the WordPress plugin Category Custom Fields (Cornea Alexandru) affecting Category Custom Fields versions from n/a through 1.0. The Red Hat entry reiterates the CSRF description. No public exploit details or patch/fix are provided in the supplied documents...
CVE-2025-23430
CVE-2025-23430 is a CSRF and XSS issue in Mass Custom Fields Manager for WordPress. Red Hat (RH:CVE-2025-23430) and Red Hat/Wordfence references confirm a CSRF-to-Reflected XSS condition affecting Mass Custom Fields Manager versions up to 1.5. The CVSS 3.1 base score is 7.1 (High) with network ac...
CVE-2025-23430 WordPress Mass Custom Fields Manager plugin <= 1.5 - CSRF to Cross Site Scripting (XSS) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Oren Yomtov Mass Custom Fields Manager allows Reflected XSS.This issue affects Mass Custom Fields Manager: from n/a through 1.5...
WordPress Category Custom Fields plugin <= 1.0 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by SOPROBRO in WordPress Plugin Category Custom Fields versions = 1.0...
WordPress Mass Custom Fields Manager plugin <= 1.5 - CSRF to Cross Site Scripting (XSS) vulnerability
CSRF to Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Mass Custom Fields Manager versions = 1.5...
WordPress plugin Category Custom Fields 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists in WordPress...
WordPress plugin Mass Custom Fields Manager 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
PT-2025-4875 · Oren Yomtov · Mass Custom Fields Manager
Name of the Vulnerable Software and Affected Versions: Oren Yomtov Mass Custom Fields Manager versions 1.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Reflected XSS. This means an attacker can trick a user into performing unintended actions on...
CVE-2025-22308
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Takashi Kitajima Smart Custom Fields smart-custom-fields allows Stored XSS.This issue affects Smart Custom Fields: from n/a through = 5.0.0...
CVE-2025-22308
CVE-2025-22308 is a stored XSS vulnerability in WordPress plugin Smart Custom Fields (aka Smart Custom Fields by Takashi Kitajima). The issue affects Smart Custom Fields versions up to 5.0.0 and is tied to improper input neutralization during web page generation (stored XSS). The vulnerability is...
CVE-2025-22308 WordPress Smart Custom FIelds plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Takashi Kitajima Smart Custom Fields smart-custom-fields allows Stored XSS.This issue affects Smart Custom Fields: from n/a through = 5.0.0...
PT-2025-4423 · Unknown · Inc2734 Smart Custom Fields
Name of the Vulnerable Software and Affected Versions: inc2734 Smart Custom Fields versions prior to 5.0.0 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows stored XSS. This problem enables attacker...
WordPress plugin Smart Custom Fields 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress plugin...
WordPress Smart Custom FIelds plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Robert DeVore Patchstack Alliance in WordPress Plugin Smart Custom Fields versions = 5.0.0...
CVE-2023-46203
Missing Authorization vulnerability in JustCoded / Alex Prokopenko Just Custom Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Just Custom Fields: from n/a through 3.3.2...
CVE-2023-46203 WordPress Just Custom Fields plugin <= 3.3.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in JustCoded / Alex Prokopenko Just Custom Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Just Custom Fields: from n/a through 3.3.2...
CVE-2023-46203 WordPress Just Custom Fields plugin <= 3.3.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in JustCoded / Alex Prokopenko Just Custom Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Just Custom Fields: from n/a through 3.3.2...
WordPress plugin Just Custom Fields 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
Cross-site Request Forgery (CSRF)
Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to insufficient checks for the permissions associated with the user sending commands. Remediation Upgrade wordpress-premium/advanced-custom-fields-pro to version 3.6.10, 6.3.4 or higher. References -...