Wpgogo develops a focused set of WordPress plugins and extensions centered on custom fields, post types, lightbox functionality, and content templating, serving web developers and site builders with modest but meaningful presence in the WordPress ecosystem. The vendor's vulnerability profile concentrates on web-application input-handling and authorization weaknesses, chiefly cross-site scripting, CSRF, insecure credential storage, and missing authorization controls, which are characteristic of plugin-layer exposure in content-management platforms. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Wpgogo over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-4324HIGH The Custom Field Template WordPress plugin before 2.5.8 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user im | Jan 2, 2023 | 7.2 | 32 | NO | NO |
CVE-2023-50372HIGH Cross-Site Request Forgery (CSRF) vulnerability in Hiroaki Miyashita Custom Post Type Page Template.This issue affects Custom Post Type Page Template: from n/a through 1.1. | Dec 18, 2023 | 8.8 | 21 | NO | NO |
CVE-2023-22695HIGH Cross-Site Request Forgery (CSRF) vulnerability in Hiroaki Miyashita Custom Field Template plugin <= 2.5.8 versions. | Jul 10, 2023 | 8.8 | 21 | NO | NO |
CVE-2022-4682MEDIUM The Lightbox Gallery WordPress plugin before 0.9.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is e | Feb 13, 2023 | 5.4 | 20 | NO | NO |
CVE-2023-38392MEDIUM Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Hiroaki Miyashita Custom Field Template plugin <= 2.5.9 versions. | Aug 7, 2023 | 6.1 | 19 | NO | NO |
CVE-2024-44062MEDIUM Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template allows Stored XSS.This issue af | Sep 15, 2024 | 5.4 | 17 | NO | NO |
CVE-2024-0627MEDIUM The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom field name column in all versions up to, and including, 2.6.1 du | Jun 11, 2024 | 5.4 | 16 | NO | NO |
CVE-2023-6745MEDIUM The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cpt' shortcode in all versions up to, and including, 2.6.1 due to insu | Jun 11, 2024 | 5.4 | 16 | NO | NO |
CVE-2020-36742MEDIUM The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1. This is due to missing or incorrect nonce valida | Jul 1, 2023 | 4.3 | 16 | NO | NO |
CVE-2024-0653MEDIUM The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.1 due to insufficient input | Jun 11, 2024 | 4.8 | 15 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Wpgogo.
Media articles that mention a CVE ID that affects a product developed by Wpgogo — matched by CVE ID, not by vendor name.