VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 13 known issues Latest disclosed Jun 29, 2026

Custom Field Template Vulnerabilities

Review known vulnerability records for the WordPress plugin Custom Field Template (`custom-field-template`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-57687, CVE-2025-68607 and CVE-2025-63058, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
13
High or Critical
1
Patch Coverage
100%
Last Updated
Jun 29, 2026
Related Security Guides

Use these guides while reviewing Custom Field Template fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize Custom Field Template remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
13
1. Match the Package
Confirm the installed WordPress plugin slug is custom-field-template before acting on any CVE from this cluster.
2. Sort by Severity
Start with 1 high or critical record, then review medium and unrated findings with public references.
3. Check Patch Evidence
13 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2022-4324 High
Vulnerability remediation for Custom Field Template

Affected range: Versions up to 2.5.7. Fixed version: 2.5.8.

CVE-2026-57687 Medium
SQL Injection remediation for Custom Field Template

Affected range: Versions up to 2.7.8. Fixed version: 2.8.

CVE-2025-68607 Medium
Stored Cross-Site Scripting remediation for Custom Field Template

Affected range: Versions up to 2.7.7. Fixed version: 2.7.8.

CVE-2024-44062 Medium
Stored Cross-Site Scripting remediation for Custom Field Template

Affected range: Versions up to 2.6.5. Fixed version: 2.6.6.

Priority CVE Quick Links

Fast paths into Custom Field Template CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
13
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2022-4324
Custom Field Template <= 2.5.7 - Authenticated (Administrator+) PHP Object Injection
 Vulnerability Versions up to 2.5.7 2.5.8 CVSS 7.2
CVE-2026-57687
Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection
 SQL Injection Versions up to 2.7.8 2.8 CVSS 6.5
CVE-2025-68607
Custom Field Template <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scri...
 Stored Cross-Site Scripting Versions up to 2.7.7 2.7.8 CVSS 6.4
CVE-2024-44062
Custom Field Template <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scri...
 Stored Cross-Site Scripting Versions up to 2.6.5 2.6.6 CVSS 6.4
CVE-2024-0627
Custom Field Template <= 2.6.1 - Authenticated(Constibutor+) Stored Cross-Site Scrip...
 Stored Cross-Site Scripting Versions up to 2.6.1 2.6.2 CVSS 6.4
CVE-2023-6745
Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Stored Cross-Site Scrip...
 Stored Cross-Site Scripting Versions up to 2.6.1 2.6.2 CVSS 6.4
CVE-2024-25919
Custom Field Template <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Script...
 Stored Cross-Site Scripting Versions up to 2.6 2.6.1 CVSS 6.4
CVE-2023-38392
Custom Field Template <= 2.5.9 - Reflected Cross-Site Scripting
 Cross-Site Scripting Versions up to 2.5.9 2.6.0 CVSS 6.1
CVE-2022-4324 High 2.5.8
CVE-2022-4324 Custom Field Template Vulnerability

Custom Field Template <= 2.5.7 - Authenticated (Administrator+) PHP Object Injection

CVE-2026-57687 Medium 2.8
CVE-2026-57687 Custom Field Template SQL Injection

Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection

CVE-2025-68607 Medium 2.7.8
CVE-2025-68607 Custom Field Template Stored Cross-Site Scripting

Custom Field Template <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2024-44062 Medium 2.6.6
CVE-2024-44062 Custom Field Template Stored Cross-Site Scripting

Custom Field Template <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2024-0627 Medium 2.6.2
CVE-2024-0627 Custom Field Template Stored Cross-Site Scripting

Custom Field Template <= 2.6.1 - Authenticated(Constibutor+) Stored Cross-Site Scripting via Custom Field Name

CVE-2023-6745 Medium 2.6.2
CVE-2023-6745 Custom Field Template Stored Cross-Site Scripting

Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

CVE-2024-25919 Medium 2.6.1
CVE-2024-25919 Custom Field Template Stored Cross-Site Scripting

Custom Field Template <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via $search_label

CVE-2023-38392 Medium 2.6.0
CVE-2023-38392 Custom Field Template Cross-Site Scripting

Custom Field Template <= 2.5.9 - Reflected Cross-Site Scripting

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for Custom Field Template so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
13 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 1 high severity finding.
Recent CVEs
CVE-2026-57687, CVE-2025-68607 and CVE-2025-63058
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Custom Field Template

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2026-57687
CVE-2026-57687: Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection

The Custom Field Template plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...

Published
Jun 29, 2026
Patched Release
2.8
Affected Versions
Versions up to 2.7.8
Next Step
Update to 2.8 or newer if supported.
Review CVE-2026-57687 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-68607
CVE-2025-68607: Custom Field Template <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and ab...

Published
Dec 24, 2025
Patched Release
2.7.8
Affected Versions
Versions up to 2.7.7
Next Step
Update to 2.7.8 or newer if supported.
Review CVE-2025-68607 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-63058
CVE-2025-63058: Custom Field Template <= 2.7.6 - Authenticated (Subscriber+) Information Exposure

The Custom Field Template plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.

Published
Dec 08, 2025
Patched Release
2.7.7
Affected Versions
Versions up to 2.7.6
Next Step
Update to 2.7.7 or newer if supported.
Review CVE-2025-63058 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-44062
CVE-2024-44062: Custom Field Template <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...

Published
Aug 29, 2024
Patched Release
2.6.6
Affected Versions
Versions up to 2.6.5
Next Step
Update to 2.6.6 or newer if supported.
Review CVE-2024-44062 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-0653
CVE-2024-0653: Custom Field Template <= 2.6.1 - Authenticated (Admin+) Stored Cross-Site Scritping

The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administ...

Published
Jun 10, 2024
Patched Release
2.6.2
Affected Versions
Versions up to 2.6.1
Next Step
Update to 2.6.2 or newer if supported.
Review CVE-2024-0653 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-6748
CVE-2023-6748: Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Information Exposure

The Custom Field Template plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the 'cft' shortcode. This makes it possible for authenticated attackers with contributor access and above, to extract sensitive data incl...

Published
Jun 10, 2024
Patched Release
2.6.2
Affected Versions
Versions up to 2.6.1
Next Step
Update to 2.6.2 or newer if supported.
Review CVE-2023-6748 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-0627
CVE-2024-0627: Custom Field Template <= 2.6.1 - Authenticated(Constibutor+) Stored Cross-Site Scripting via Custom Field Name

The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom field name column in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied custom fields. This makes...

Published
Jun 10, 2024
Patched Release
2.6.2
Affected Versions
Versions up to 2.6.1
Next Step
Update to 2.6.2 or newer if supported.
Review CVE-2024-0627 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-6745
CVE-2023-6745: Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cpt' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied post meta. This makes it possible f...

Published
Jun 10, 2024
Patched Release
2.6.2
Affected Versions
Versions up to 2.6.1
Next Step
Update to 2.6.2 or newer if supported.
Review CVE-2023-6745 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-25919
CVE-2024-25919: Custom Field Template <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via $search_label

The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $search_label parameter in versions up to, and including, 2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with c...

Published
Feb 14, 2024
Patched Release
2.6.1
Affected Versions
Versions up to 2.6
Next Step
Update to 2.6.1 or newer if supported.
Review CVE-2024-25919 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-38392
CVE-2023-38392: Custom Field Template <= 2.5.9 - Reflected Cross-Site Scripting

The Custom Field Template plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

Published
Jul 24, 2023
Patched Release
2.6.0
Affected Versions
Versions up to 2.5.9
Next Step
Update to 2.6.0 or newer if supported.
Review CVE-2023-38392 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-22695
CVE-2023-22695: Custom Field Template <= 2.5.8 - Cross-Site Request Forgery via Plugin Options Update

The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.8. This is due to missing or incorrect nonce validation on the 'custom_field_template_admin' function. This makes it possible for unauthenticated attac...

Published
Mar 21, 2023
Patched Release
2.5.9
Affected Versions
Versions up to 2.5.8
Next Step
Update to 2.5.9 or newer if supported.
Review CVE-2023-22695 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2022-4324
CVE-2022-4324: Custom Field Template <= 2.5.7 - Authenticated (Administrator+) PHP Object Injection

The Custom Field Template plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.5.7 via deserialization of untrusted input in the custom_field_template_admin function. This allows administrator-level attackers to inject a PHP Object. No PO...

Published
Dec 09, 2022
Patched Release
2.5.8
Affected Versions
Versions up to 2.5.7
Next Step
Update to 2.5.8 or newer if supported.
Review CVE-2022-4324 fixed version details Open CVE Reference