CVE-2023-2023: Kunalnagar Custom 404 Pro

Medium severity, CVSS 6.1. EPSS: 1.7% chance of exploitation in the next 30 days.

The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.

Affected products

• Kunalnagar Custom 404 Pro: before 3.7.3 (fixed in 3.7.3)

Published 2023-05-30. Last modified 2026-06-17.