What’s Vulnerable › Vulnerabilities
CVE-2026-6433: Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCE
- Severity: high (CVSS 7.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-05-11 · updated 2026-06-17
Description
The Custom css-js-php WordPress plugin through 2.0.7 does not properly sanitize user input before using it in a SQL query, and the result is passed to eval(), allowing unauthenticated users to execute arbitrary PHP code on the server.
Affected products
- Custom css-js-php: from 2.0.7 through 2.0.7
References
Get alerted when CVE-2026-6433 or the next vulnerability affects your stack