Custom CSS

Custom CSS has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.

The most common weakness is Missing Authorization, behind 1 of the records (100%).

The one issue recorded for Custom CSS has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

All of these findings were reported by Nabil Irawan. Custom CSS is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.6.30.

Strategic Overview

Avg CVSSMedium

5.3/ 10

Patch Coverage0%

Open

Fixed

Get automatic notifications for all Custom CSS vulnerabilities before they are exploited.

Most severe open issueCVSS 5.3CVE-2025-48096

Custom CSS <= 1.4.0 - Missing Authorization

Read the full analysis

Vulnerability Records

1 records


2025-10-08 00:00	Custom CSS <= 1.4.0 - Missing Authorization Custom CSS <= 1.4.0	`CVE-2025-48096`	5.3 Medium	Nabil Irawan	No

Showing 1–1 of 1 reports

Latestv1.4.0

Custom CSS

Author

FRESHFACE

2.5(17)

50/100

Last Updated

2017-11-28 (9y ago)

Active Installs

1,000+

Downloads

69,892

Requires WP

4.0.0+

Requires PHP

Tested up to

WP 4.6.30

Created

2015-09-01 (11y ago)

Create custom CSS and JS codes. Delivered with our awesome Conditional Logic, you can easily specify where you want to your custom CSS code appear. You can write your CSS and JS codes inside nice ACE editor with syntax highlighter.Codes will be still presented, after you change the theme, so this is really good way to write CSS adjustments into your theme.

View on WordPress.org