WordPress custom-field-suite has 7 known advisories in the phpwarden feed. Feed 2026.10.28.3, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2019-11871 | The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins. | medium | 5.4 | <2.5.15 | 2.5.15 |
| CVE-2024-3562 | The Custom Field Suite plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.6.7 via the Loop cus | high | 8.8 | <=2.6.7 | – |
| CVE-2024-3068 | The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cfs[fields][*][name]' parameter in all ver | medium | 4.4 | <2.6.6 | 2.6.6 |
| CVE-2024-3561 | The Custom Field Suite plugin for WordPress is vulnerable to SQL Injection via the the 'Term' custom field in all versions up to, and includ | high | 8.8 | <=2.6.7 | – |
| CVE-2024-3558 | The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfs[post_title]' parameter versions up | medium | 6.4 | <=2.6.7 | – |
| CVE-2024-0689 | The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a meta import in all versions up to, and includ | medium | 4.4 | <2.6.5 | 2.6.5 |
| CVE-2024-3559 | The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfs[post_content]' parameter versions | medium | 6.4 | <=2.6.7 | – |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked