Vulnerabilities

TI-2024-29651 CVE-2024-44062 · GHSA-4jmq-3rrv-cmcc

WordPress Custom Field Template plugin <= 2.6.5 - Cross Site Scripting (XSS) vulnerability

LOW 29

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template allows Stored XSS.This issue affects Custom Field Template: from n/a th…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00277 Published 2024-09-15 No fix listed CWE-79

TI-2024-00603 CVE-2024-0653 · GHSA-3xp5-3hvv-rw8c

Custom Field Template <= 2.6.1 - Authenticated (Admin+) Stored Cross-Site Scritping

LOW 22

The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00247 Published 2024-06-11 No fix listed CWE-79

TI-2023-06167 CVE-2023-6748 · GHSA-4947-94mr-v96v

Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Information Exposure

LOW 20

The Custom Field Template plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the 'cft' shortcode.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0029 Published 2024-06-11 No fix listed CWE-862

TI-2024-00582 CVE-2024-0627 · GHSA-prm3-v4r8-g2mv

Custom Field Template <= 2.6.1 - Authenticated(Constibutor+) Stored Cross-Site Scripting via Custom Field Name

LOW 28

The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom field name column in all versions up to, and including, 2.6.1 due to insufficient input sanitization and…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00263 Published 2024-06-11 No fix listed CWE-79

TI-2023-06164 CVE-2023-6745 · GHSA-pwvr-q337-w45r

Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

LOW 28

The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cpt' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output e…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00257 Published 2024-06-11 No fix listed CWE-79

TI-2023-19776 CVE-2023-38392 · GHSA-7gmr-wxmp-8ph5

WordPress Custom Field Template Plugin <= 2.5.9 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Hiroaki Miyashita Custom Field Template plugin <= 2.5.9 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0041 Published 2023-08-07 No fix listed CWE-79

TI-2023-08870 CVE-2023-22695 · GHSA-75x2-mhj5-v895

WordPress Custom Field Template Plugin <= 2.5.8 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Hiroaki Miyashita Custom Field Template plugin <= 2.5.8 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00321 Published 2023-07-10 No fix listed CWE-352

TI-2020-18911 CVE-2020-36742 · GHSA-j256-v92m-fqff

Custom Field Template <= 2.5.1 - Cross-Site Request Forgery Bypass

LOW 20

The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00384 Published 2023-07-01 Fixed in 2.5.2 CWE-352

TI-2022-03960 CVE-2022-4324 · GHSA-482p-fj3c-xcw8

Custom Field Template < 2.5.8 - Admin+ PHP Object Injection

HIGH 67

The Custom Field Template WordPress plugin before 2.5.8 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.17686 Published 2023-01-02 Fixed in 2.5.8

Vulnerabilities

Filters