Code injection in josevega Display custom fields in the frontend – Post and User Profile…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Code Injection via the plugin's vg_display_data shortcode in all versions up to, and including, 1.2.1 due to insufficient input validation and restriction on access to that shortcode. This makes it possible for authenticated attackers with contributor-level and above permissions to call arbitrary functions and execute code.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| josevega | Display custom fields in the frontend – Post and User Profile Fields | up to 1.2.1 | — | No fix listed | CNA |
- Display custom fields in the frontend – Post and User Profile Fields Vendorjosevega Affected up to 1.2.1 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vegacorp:display_custom_fields_in_the_frontend_-_post_and_user_profile_fields:*:*:*:*:*:wordpress:*:* | before 1.3.0 | Vulnerable | Vegacorp |
- cpe:2.3:a:vegacorp:display_custom_fields_in_the_frontend_-_post_and_user_profile_fields:*:*:*:*:*:wordpress:*:* Versions before 1.3.0 Vulnerable ·Vegacorp
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-6996
- 2026-10-03 Alias added: GHSA-g7rx-4mww-c3pc
References
Patch 2
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e0662c3a-5b82-4b9a-aa69-147094930d1f?source=cve
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3021133%40shortcode-to-display-post-and-user-data&new=3021133%40shortcode-to-display-post-and-user-data&sfp_email=&sfph_mail=
More josevega vulnerabilities
- TI-2025-35752 WordPress WP Frontend Admin plugin <= 1.22.7 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
- TI-2023-06383 Cross-site scripting in josevega Display custom fields in the frontend – Post and User… CVSS 3.1MEDIUM 6.4
- TI-2022-04562 Freemius SDK <= 2.4.2 - Missing Authorization Checks CVSS 3.1MEDIUM 6.3
- TI-2024-12404 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter CVSS 3.1MEDIUM 6.1
- TI-2026-44324 WordPress WooCommerce Bulk Edit Products – WP Sheet Editor plugin <= 1.8.21 - Broken Access Control vulnerability CVSS 3.1MEDIUM 4.9
- TI-2023-14799 WordPress Shortcode to display post and user data plugin <= 1.2.0 - Broken Access Control vulnerability CVSS 3.1MEDIUM 4.3
Sources
- CVE-2023-6996 · CVE Program
- CVE-2023-6996 · NVD
- FIRST EPSS
- GHSA-g7rx-4mww-c3pc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences