WordPress custom-404-pro has 5 known advisories in the phpwarden feed. Feed 2026.10.29.3, updated 2026-10-29.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2023-2023 | The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross- | medium | 6.1 | <3.7.3 | 3.7.3 |
| CVE-2019-14789 | The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter. | medium | 6.1 | =3.2.8 | – |
| CVE-2019-15838 | The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789. | medium | 6.1 | <3.2.8 | 3.2.8 |
| CVE-2023-2032 | The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabiliti | critical | 9.8 | <3.8.1 | 3.8.1 |
| CVE-2023-0385 | The Custom 404 Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.7.1. This is due to | medium | 4.3 | <3.7.2 | 3.7.2 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden wordpress /var/www/html # or, without Composer pipx install phpwarden && phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked