Critical severity9.6NVD Advisory· Published Apr 16, 2025· Updated Apr 23, 2026

CVE-2025-39601

Description

Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Custom CSS, JS & PHP custom-css allows Remote Code Inclusion.This issue affects Custom CSS, JS & PHP: from n/a through <= 2.4.1.

Affected products

Wpfactory/Custom CSS\, Js \& PHPllm-fuzzy
Range: <=2.4.1

Patches

Vulnerability mechanics

References

patchstack.com/database/Wordpress/Plugin/custom-css/vulnerability/wordpress-custom-css-js-php-plugin-2-4-1-csrf-to-rce-vulnerabilitynvd

News mentions

No linked articles in our index yet.

cvss	0.624
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000