Wpfactory Custom Css, Js & PHP vulnerabilities

2 CVEs affecting Wpfactory Custom Css, Js & PHP, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-39601, published 2025-04-16.

More from Wpfactory.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-4418, published 2023-10-20. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the save()…
• CVE-2025-39601, published 2025-04-16. Critical severity, CVSS 9.6. EPSS: 0.3% chance of exploitation in the next 30 days. Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Custom CSS, JS & PHP custom-css allows Remote Code Inclusion.This issue affects Custom CSS, JS & PHP: from n/a through <= 2.4.1.