Read the docs

Kunal Nagar

Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

Kunal Nagar records in CISA KEV

No Kunal Nagar vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Custom 404 Pro 9 records HIGH

Records

10 records

TI-2023-01909 CVE-2023-2032 · GHSA-mr4p-2m35-4m4g

Custom 404 Pro < 3.8.1 - Multiple SQL Injection

Priority HIGH 82

The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabilities.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00934 Published 2023-06-27 Fixed in 3.8.1
TI-2023-01900 CVE-2023-2023 · GHSA-2h88-qxq3-v97j

Custom 404 Pro < 3.7.3 - Reflected Cross-Site Scripting

Priority MEDIUM 60

The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0171 Published 2023-05-30 Fixed in 3.7.3 CWE-79
TI-2025-09128 CVE-2025-9947 · GHSA-c979-5q93-gppm

Custom 404 Pro <= 3.12.0 - Authenticated (Administrator+) SQL Injection via `path` Parameter

Priority LOW 22

The Custom 404 Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘path’ parameter in all versions up to, and including, 3.12.0 due to insufficient escaping on the user supplied parameter and lack…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00296 Published 2025-10-11 No fix listed CWE-89
TI-2023-00369 CVE-2023-0385 · GHSA-r65v-776h-88pg

Custom 404 Pro <= 3.7.1 - Cross-Site Request Forgery

Priority LOW 20

The Custom 404 Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.7.1.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00331 Published 2023-01-18 No fix listed CWE-352
Open these records in search →