Custom Field Template vulnerabilities | LiveThreat CVE Feed

Product

Custom Field Template

by hiroaki-miyashita · last CVE Sep 22, 2026

CVEs

On KEV

8.8

Max CVSS

New 30D

Vulnerabilities14 In the news0 Timeline

Severity mix

Critical 0High 2Medium 12Low 0

Severity

All severities14 Critical0 High2 Medium12 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Custom Field Template to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-9855	6.5	1%	Sep 19	Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter Affected: through 2.7.8
CVE-2025-68607	6.5	0%	Dec 29	WordPress Custom Field Template plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability Affected: through 2.7.7
CVE-2024-25919	6.5	0%	Mar 15	WordPress Custom Field Template plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability Affected: through 2.6
CVE-2023-38392	6.1	0%	Aug 7	WordPress Custom Field Template Plugin <= 2.5.9 is vulnerable to Cross Site Scripting (XSS) Affected: through 2.5.9
CVE-2024-44062	5.4	0%	Sep 15	WordPress Custom Field Template plugin <= 2.6.5 - Cross Site Scripting (XSS) vulnerability Affected: through 2.6.5
CVE-2024-0627	5.4	0%	Jun 11	Custom Field Template <= 2.6.1 - Authenticated(Constibutor+) Stored Cross-Site Scripting via Custom Field Name Affected: through 2.6.1
CVE-2023-6745	5.4	0%	Jun 11	Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode Affected: through 2.6.1
CVE-2024-0653	4.8	0%	Jun 11	Custom Field Template <= 2.6.1 - Authenticated (Admin+) Stored Cross-Site Scritping Affected: through 2.6.1
CVE-2026-12995	4.3	0%	Sep 22	Custom Field Template <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter Affected: through 2.7.8
CVE-2025-63058	4.3	0%	Dec 9	WordPress Custom Field Template plugin <= 2.7.6 - Sensitive Data Exposure vulnerability Affected: through 2.7.6
CVE-2023-6748	4.3	0%	Jun 11	Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Information Exposure Affected: through 2.6.1
CVE-2020-36742	4.3	0%	Jul 1	Custom Field Template <= 2.5.1 - Cross-Site Request Forgery Bypass Affected: before 2.5.2