CVE-2026-6433 — Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCE
The Custom css-js-php WordPress plugin through 2.0.7 does not properly sanitize user input before using it in a SQL query, and the result is passed to eval(), allowing unauthent…
Published: 2026-05-11 · CVSS: 7.3 · CVSS 3.1
The Custom css-js-php WordPress plugin through 2.0.7 does not properly sanitize user input before using it in a SQL query, and the result is passed to eval(), allowing unauthenticated users to execute arbitrary PHP code on the server.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7