Vulnerabilities

TI-2025-30466 CVE-2025-48096 · GHSA-c9x3-8c6j-hwjf

WordPress Custom CSS plugin <= 1.4.0 - Broken Access Control vulnerability

LOW 35

Missing Authorization vulnerability in FRESHFACE Custom CSS custom-css-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom CSS: from n/a through <= 1.4.0.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00299 Published 2025-10-22 No fix listed CWE-862

TI-2025-19832 CVE-2025-26961 · GHSA-w3p7-73q2-q3hc

WordPress Fresh Framework plugin <= 1.70.0 - Unauthenticated Broken Access Control vulnerability

LOW 37

Missing Authorization vulnerability in FRESHFACE Fresh Framework fresh-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Fresh Framework: from n/a through <= 1.70.0.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00337 Published 2025-03-15 No fix listed CWE-862

TI-2025-19807 CVE-2025-26936 · GHSA-93g2-pf5q-hqxr

WordPress Fresh Framework plugin <= 1.70.0 - Unauthenticated Remote Code Execution (RCE) vulnerability

MEDIUM 49

Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Fresh Framework fresh-framework allows Code Injection.This issue affects Fresh Framework: from n/a through <= 1.70.0.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00491 Published 2025-03-10 No fix listed CWE-94

Vulnerabilities

Filters

WordPress Custom CSS plugin <= 1.4.0 - Broken Access Control vulnerability

WordPress Fresh Framework plugin <= 1.70.0 - Unauthenticated Broken Access Control vulnerability

WordPress Fresh Framework plugin <= 1.70.0 - Unauthenticated Remote Code Execution (RCE) vulnerability