What’s Vulnerable › Vulnerabilities

CVE-2023-2032: Custom 404 Pro < 3.8.1 - Multiple SQL Injection

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-06-27 · updated 2026-06-17

Description

The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabilities.

Affected products

• Kunal Nagar Custom 404 Pro: before 3.8.1 — fixed in 3.8.1

How to fix

Upgrade to a fixed version: Kunal Nagar Custom 404 Pro 3.8.1. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/17acde5d-44ea-4e77-8670-260d22e28ffe
• https://wpscan.com/vulnerability/17acde5d-44ea-4e77-8670-260d22e28ffe

Get alerted when CVE-2023-2032 or the next vulnerability affects your stack