CVE-2026-6433 — Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCE

CVE-2026-6433

Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCE PUBLISHED

Description (CNA)

The Custom css-js-php WordPress plugin through 2.0.7 does not properly sanitize user input before using it in a SQL query, and the result is passed to eval(), allowing unauthenticated users to execute arbitrary PHP code on the server.

Affected (CNA)

Vendor / product	Versions
Unknown / Custom css-js-php	affected 2.0.7 through 2.0.7

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/a0b1c059-e156-4402-ac8d-67f8ad7386cc/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.