CVE-2026-6433 - Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCE

Back Back to CVE browser

HIGH

Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCE

Published May 11, 2026

7.3

HIGH

CVSS 3.1

EPSS 0.81%

Description

The Custom css-js-php WordPress plugin through 2.0.7 does not properly sanitize user input before using it in a SQL query, and the result is passed to eval(), allowing unauthenticated users to execute arbitrary PHP code on the server.

Affected products

Vendor n/a Product Custom css-js-php Default
n/a
- Version
  2.0.7
  Status
  affected
  Constraints
  <=2.0.7

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Custom css-js-php

n/a

Version	Status	Constraints
2.0.7	affected	<=2.0.7

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29034
Advisory
https://wpscan.com/vulnerability/a0b1c059-e156-4402-ac8d-67f8ad7386cc/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29034		Advisory
https://wpscan.com/vulnerability/a0b1c059-e156-4402-ac8d-67f8ad7386cc/		exploitvdb-entrytechnical-description