Custom Field Template vulnerabilities | LiveThreat CVE Feed

Product

Custom Field Template

by hiroaki-miyashita · last CVE Sep 22, 2026

CVEs

On KEV

8.5

Max CVSS

New 30D

Vulnerabilities10 In the news0 Timeline

Severity mix

Critical 0High 1Medium 9Low 0

Severity

All severities10 Critical0 High1 Medium9 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Custom Field Template to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-57687	8.5	0%	Jul 2	WordPress Custom Field Template plugin <= 2.7.8 - SQL Injection vulnerability Affected: through 2.7.8
CVE-2026-9855	6.5	1%	Sep 19	Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter Affected: through 2.7.8
CVE-2025-68607	6.5	0%	Dec 29	WordPress Custom Field Template plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability Affected: through 2.7.7
CVE-2024-44062	5.4	0%	Sep 15	WordPress Custom Field Template plugin <= 2.6.5 - Cross Site Scripting (XSS) vulnerability Affected: through 2.6.5
CVE-2024-0627	5.4	0%	Jun 11	Custom Field Template <= 2.6.1 - Authenticated(Constibutor+) Stored Cross-Site Scripting via Custom Field Name Affected: through 2.6.1
CVE-2023-6745	5.4	0%	Jun 11	Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode Affected: through 2.6.1
CVE-2024-0653	4.8	0%	Jun 11	Custom Field Template <= 2.6.1 - Authenticated (Admin+) Stored Cross-Site Scritping Affected: through 2.6.1
CVE-2026-12995	4.3	0%	Sep 22	Custom Field Template <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter Affected: through 2.7.8
CVE-2025-63058	4.3	0%	Dec 9	WordPress Custom Field Template plugin <= 2.7.6 - Sensitive Data Exposure vulnerability Affected: through 2.7.6
CVE-2023-6748	4.3	0%	Jun 11	Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Information Exposure Affected: through 2.6.1