CVE-2024-39646 HIGH

CVE-2024-39646: WordPress Custom 404 Pro plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerability

Vendor Kunal
Product Custom 404 Pro
Weakness CWE-79 · XSS
Published August 1, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kunal Custom 404 Pro custom-404-pro.This issue affects Custom 404 Pro: from n/a through <= 3.11.1.

Explanation of Vulnerability in Simple Terms

02Summary

Custom 404 Pro versions up to 3.11.1 contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages. The vulnerability requires user interaction—typically clicking a malicious link—and can affect multiple users if the injected content is stored. Site visitors may have their sessions hijacked, credentials stolen, or be redirected to phishing pages.

What an attacker can do

03Attacker Capabilities

Inject malicious JavaScript that runs in visitors' browsers, stealing session cookies or redirecting users to phishing sites.

Potential impact on your site

04Site Impact

Visitors' browsers can be compromised; their sessions hijacked or credentials stolen without your knowledge.

Conditions required to exploit

05Prerequisites

No authentication required. Attacker must trick a user into clicking a malicious link or visiting a crafted page.

Key dates

06Disclosure timeline

August 1, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57359 WordPress ReviewX plugin <= 2.3.10 - Cross Site Scripting (XSS) vulnerability CVE-2026-57684 WordPress TheFox theme <= 3.9.70 - Cross Site Scripting (XSS) vulnerability CVE-2026-57673 WordPress Optimole plugin <= 4.2.7 - Cross Site Scripting (XSS) vulnerability CVE-2026-27404 WordPress LMS theme <= 9.7 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-69156 WordPress Kids Zone - Children WordPress Theme theme <= 5.4 - Cross Site Scripting (XSS) vulnerability