high7.3
CVE-2026-6433
The Custom css-js-php WordPress plugin through 2.0.7 does not properly sanitize user input before using it in a SQL query, and the result is passed to eval(), …
Impact
The Custom css-js-php WordPress plugin through 2.0.7 does not properly sanitize user input before using it in a SQL query, and the result is passed to eval(), allowing unauthenticated users to execute arbitrary PHP code on the server.
Affected products
| Product | Affected versions |
|---|---|
| Custom Css-Js-Php WordPress Plugin | through 2.0.7 |
Versions were read from the advisory text. No structured product data has been published for this record yet.