Kunalnagar Custom 404 Pro vulnerabilities
10 known vulnerabilities affecting kunalnagar/custom_404_pro.
Total CVEs
10
CISA KEV
0
Public exploits
3
Exploited in wild
1
Severity breakdown
CRITICAL1HIGH1MEDIUM8
Vulnerabilities
Page 1 of 1
CVE-2024-39646P1MEDIUMCVSS 6.1ExploitedPoCfixed in 3.11.22024-08-01
CVE-2024-39646 [MEDIUM] CWE-79 CVE-2024-39646: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kunal Custom 404 Pro custom-404-pro.This issue affects Custom 404 Pro: from n/a through <= 3.11.1.
nvd
CVE-2019-14789P3MEDIUMCVSS 6.1PoCv3.2.82019-08-15
CVE-2019-14789 [MEDIUM] CWE-79 CVE-2019-14789: The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page
The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.
nvd
CVE-2023-2023P3MEDIUMCVSS 6.1PoCfixed in 3.7.32023-05-30
CVE-2023-2023 [MEDIUM] CWE-79 CVE-2023-2023: The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in
The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.
nvd
CVE-2023-2032P3CRITICALCVSS 9.8fixed in 3.8.12023-06-27
CVE-2023-2032 [CRITICAL] CWE-89 CVE-2023-2032: The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading
The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabilities.
nvd
CVE-2022-47605P3HIGHCVSS 7.2≤ 3.7.02023-04-12
CVE-2022-47605 [HIGH] CWE-89 CVE-2022-47605: Auth. SQL Injection') vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.7.0 versions.
Auth. SQL Injection') vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.7.0 versions.
nvd
CVE-2025-9947P4MEDIUMCVSS 4.9≤ 3.12.02025-10-11
CVE-2025-9947 [MEDIUM] CWE-89 CVE-2025-9947: The Custom 404 Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘path’ par
The Custom 404 Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘path’ parameter in all versions up to, and including, 3.12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level acc
nvd
CVE-2023-51540P4MEDIUMCVSS 6.1≤ 3.10.02024-02-01
CVE-2023-51540 [MEDIUM] CWE-79 CVE-2023-51540: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kunal Nagar Custom 404 Pro allows Stored XSS.This issue affects Custom 404 Pro: from n/a through 3.10.0.
nvd
CVE-2019-15838P4MEDIUMCVSS 6.1fixed in 3.2.82019-08-30
CVE-2019-15838 [MEDIUM] CVE-2019-15838: The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability th
The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789.
nvd
CVE-2023-32740P4MEDIUMCVSS 6.1≤ 3.8.12023-08-30
CVE-2023-32740 [MEDIUM] CWE-79 CVE-2023-32740: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.8.1 versions.
nvd
CVE-2023-0385P4MEDIUMCVSS 4.3fixed in 3.7.2≤ 3.7.12023-01-18
CVE-2023-0385 [MEDIUM] CWE-352 CVE-2023-0385: The Custom 404 Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up t
The Custom 404 Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.7.1. This is due to missing or incorrect nonce validation on the custom_404_pro_admin_init function. This makes it possible for unauthenticated attackers to delete logs, via forged request granted they can trick a site administrator
nvd