Vulnerabilities

TI-2026-08854 CVE-2026-10100 · GHSA-855q-xm3j-j7h8

Simple Custom Login Page <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting

LOW 20

The Simple Custom Login Page plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the color settings fields (Page Background, Form Background, Text Color, Link Color) in versions up to and including 1.0.…

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00183 Published 2026-06-02 No fix listed CWE-79

TI-2026-03523 CVE-2026-4068 · GHSA-v95j-rfx2-j67m

Add Custom Fields to Media <= 2.0.3 - Cross-Site Request Forgery to Custom Field Deletion via 'delete' Parameter

LOW 19

The Add Custom Fields to Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.3.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00137 Published 2026-03-19 No fix listed CWE-352

Vulnerabilities

Filters

Simple Custom Login Page <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting

Add Custom Fields to Media <= 2.0.3 - Cross-Site Request Forgery to Custom Field Deletion via 'delete' Parameter