CVE-2026-6433

7.3 highEPSS 1.2%

High (7.3). EPSS 1.2% chance of exploitation in the next 30 days.

The Custom css-js-php WordPress plugin through 2.0.7 does not properly sanitize user input before using it in a SQL query, and the result is passed to eval(), allowing unauthenticated users to execute arbitrary PHP code on the server.

Severity

CVSS 3.1

7.3 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
Published: 2026-05-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://wpscan.com/vulnerability/a0b1c059-e156-4402-ac8d-67f8ad7386cc/

Check your stack JSON