Vulnerabilities

TI-2025-09128 CVE-2025-9947 · GHSA-c979-5q93-gppm

Custom 404 Pro <= 3.12.0 - Authenticated (Administrator+) SQL Injection via `path` Parameter

LOW 22

The Custom 404 Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘path’ parameter in all versions up to, and including, 3.12.0 due to insufficient escaping on the user supplied parameter and lack…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00296 Published 2025-10-11 No fix listed CWE-89

TI-2024-26570 CVE-2024-39646 · GHSA-ppfv-j8g7-xg43

WordPress Custom 404 Pro plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 32

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kunal Custom 404 Pro custom-404-pro.This issue affects Custom 404 Pro: from n/a through <= 3.11.1.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00624 Published 2024-08-01 No fix listed CWE-79

TI-2023-28192 CVE-2023-51540 · GHSA-77pp-vwgv-x2jq

WordPress Custom 404 Pro Plugin <= 3.10.0 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kunal Nagar Custom 404 Pro allows Stored XSS.This issue affects Custom 404 Pro: from n/a through 3.10.0.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00351 Published 2024-02-01 No fix listed CWE-79

TI-2023-16006 CVE-2023-32740 · GHSA-vc4q-qp4q-6g4v

WordPress Custom 404 Pro Plugin <= 3.8.1 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.8.1 versions.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0034 Published 2023-08-30 No fix listed CWE-79

TI-2023-01909 CVE-2023-2032 · GHSA-mr4p-2m35-4m4g

Custom 404 Pro < 3.8.1 - Multiple SQL Injection

HIGH 82

The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabilities.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00934 Published 2023-06-27 Fixed in 3.8.1

TI-2023-01900 CVE-2023-2023 · GHSA-2h88-qxq3-v97j

Custom 404 Pro < 3.7.3 - Reflected Cross-Site Scripting

MEDIUM 60

The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0171 Published 2023-05-30 Fixed in 3.7.3 CWE-79

TI-2022-23643 CVE-2022-47605 · GHSA-jpg4-8c5p-qm22

WordPress Custom 404 Pro Plugin <= 3.7.0 is vulnerable to SQL Injection (SQLi)

LOW 39

Auth. SQL Injection') vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.7.0 versions.

CVSS 3.1HIGH 8.3 Network High privileges User interaction EPSS 0.00668 Published 2023-04-12 No fix listed CWE-89

TI-2023-00369 CVE-2023-0385 · GHSA-r65v-776h-88pg

Custom 404 Pro <= 3.7.1 - Cross-Site Request Forgery

LOW 20

The Custom 404 Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.7.1.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00331 Published 2023-01-18 No fix listed CWE-352

TI-2019-11905 CVE-2019-15838 · GHSA-g72f-hwgc-jc3h

The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789.

LOW 29

The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0095 Published 2019-08-30 No fix listed CWE-79

TI-2019-10995 CVE-2019-14789 · GHSA-3wh3-p2p8-722q

The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.

LOW 30

The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01611 Published 2019-08-15 No fix listed CWE-79

Vulnerabilities

Filters