Custom Field Template

Explore Custom Field Template vulnerabilities across all versions. Currently tracking 13 known vulnerabilities, including severity, impact, and patch status.

01234567891004.09.2008Today16.09.20204.3Custom Field Template <= 2.5.1 - Cross-Site Request Forgery Bypass CVSS 4.3 · 16.09.202009.12.20227.2Custom Field Template <= 2.5.7 - Authenticated (Administrator+) PHP Object Injection CVSS 7.2 · 09.12.202221.03.20234.3Custom Field Template <= 2.5.8 - Cross-Site Request Forgery via Plugin Options Update CVSS 4.3 · 21.03.202324.07.20236.1Custom Field Template <= 2.5.9 - Reflected Cross-Site Scripting CVSS 6.1 · 24.07.202314.02.20246.4Custom Field Template <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via $search_label CVSS 6.4 · 14.02.202410.06.20246.4Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode CVSS 6.4 · 10.06.20246.4Custom Field Template <= 2.6.1 - Authenticated(Constibutor+) Stored Cross-Site Scripting via Custom Field Name CVSS 6.4 · 10.06.20244.3Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Information Exposure CVSS 4.3 · 10.06.20244.4Custom Field Template <= 2.6.1 - Authenticated (Admin+) Stored Cross-Site Scritping CVSS 4.4 · 10.06.202429.08.20246.4Custom Field Template <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 29.08.202408.12.20254.3Custom Field Template <= 2.7.6 - Authenticated (Subscriber+) Information Exposure CVSS 4.3 · 08.12.202524.12.20256.4Custom Field Template <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 24.12.202529.06.20266.5Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection CVSS 6.5 · 29.06.2026

Strategic Overview

Avg CVSSMedium
5.6/ 10
Patch Coverage100%
Open

0

Fixed

13

Get automatic notifications for all Custom Field Template vulnerabilities before they are exploited.

Vulnerability Records

13 records
2026-06-29 00:00CVE-2026-57687
6.5
Medium
darooYes
2025-12-24 00:00CVE-2025-68607
6.4
Medium
Muhammad Yudha - DJYes
2025-12-08 00:00CVE-2025-63058
4.3
Medium
Phat RiOYes
2024-08-29 00:00CVE-2024-44062
6.4
Medium
Robert DeVoreYes
2024-06-10 00:00CVE-2023-6745
6.4
Medium
Francesco CarlucciYes
2024-06-10 00:00CVE-2024-0627
6.4
Medium
Luk 6785Yes
2024-06-10 00:00CVE-2023-6748
4.3
Medium
Francesco CarlucciYes
2024-06-10 00:00CVE-2024-0653
4.4
Medium
catfatherYes
2024-02-14 00:00CVE-2024-25919
6.4
Medium
LVT-tholv2kYes
2023-07-24 00:00CVE-2023-38392
6.1
Medium
PhdYes
Showing 1–10 of 13 reports
Custom Field Template banner
Latestv2.8

Custom Field Template

Hiroaki Miyashita

Author

Hiroaki Miyashita

4.0(24)
80/100
Last Updated
2026-06-29 (1mo ago)
Active Installs
30,000+
Downloads
1,225,880
Requires WP
2.1+
Requires PHP
0+
Tested up to
WP 7.0.2
Created
2008-09-04 (18y ago)

The Custom Field Template plugin adds the default custom fields on the Write Post/Page. The template format is almost same as the one of the rc:custom_field_gui plugin. The difference is following. English Custom Field Template Manual We have finally published a manual site for the custom field template plugin. You can also use the custom field refinement search for posts in the admin panel. Please check here. You can set any number of the custom field templates and switch the templates when you write/edit the post/page. This plugin does not use the ini file for the template but set it in the option page of the plugin. Support for TinyMCE in the textarea. Support for media buttons in the textarea. – requires at least 2.5. Support for multiple fields with the same key. Support for hideKey and label options. You can see the full option list in the setting page of the plugin. You can customize the design of custom field template with css. You can replace custom keys by labels. You can use wpautop function. You can use PHP codes in order to set values. (experimental, code = 0) You can set an access user level in each field. (level = 1) Supprt for inserting custom field values into tags automatically. (insertTag = true) Adds [cft] Shortcode to display the custom field template. (only shows the attributes which have output = true) Adds template instruction sections. Adds the value label option for the case that values are diffrent from viewed values. (valueLabel = apples # oranges # bananas) Adds the blank option. (blank = true) Adds the break type. Set CSS of &#8216;#cft div’. (type = break) Adds [cft] Shortcode Format. Adds the sort option. (sort = asc, sort = desc, sort = order) Support for Quick Edit of custom fields. (tinyMCE and mediaButton are not supported yet) Support for the custom field search. (only shows the attributes which have search = true.) Adds [cftsearch] Shortcode Format. (under development) Adds PHP codes for the output value. (outputCode = 0) Adds PHP codes before saving the values. (editCode = 0) Adds the save functionality. Adds the class option. (class = text) Adds the auto hook of the_content(). (experimental) You can use the HTML Editor in the textarea. (htmlEditor = true) Adds the box title replacement option. Adds the select option of the post type. Adds the value count option. Adds the option to use the shortcode in the widhet. Adds the attributes of JavaScript Event Handlers. (onclick = alert('ok');) Adds the Initialize button. Adds the attributes of before and after text. (before = blah, after = blah) Adds the export and import functionality. Adds the style attribute. (style = color:#FF0000;) Adds the maxlength attribute. (maxlength = 10) Adds the attributes of multiple fields. (multiple = true, startNum = 5, endNum = 10, multipleButton = true) Adds the attributes of the date picker in text type. (date = true, dateFirstDayOfWeek = 0, dateFormat = yyyy/mm/dd) Adds the filter of page template file names (Thanks, Joel Pittet). Adds the attribute of shortCode in order to output the shortcode filtered values. (shortCode = true) Adds the attribute of outputNone in case there is no data to output. (outputNone = No Data) Adds the attribute of singleList attribute in order to output with <ul><li> if the value is single. ex) singleList = true Adds the file upload type. (type = file) Adds the fieldset type. (type = fieldset_open, type = fieldset_close) Adds the option to deploy the box in each template. Localization Belorussian (by_BY) – Marcis Gasuns Catalan (ca) – Andreu Llos Czech (cs_CZ) – Jakub German (de_DE) – F J Kaiser Spanish (es_ES) – Dario Ferrer Farsi (fa_IR) – Mehdi Zare French (fr_FR) – Nicolas Lemoine Hungarian (hu_HU) – Balazs Kovacs Indonesian (id_ID) – Masino Sinaga Italian (it_IT) – Gianni Diurno Japanese (ja) – Hiroaki Miyashita Dutch (nl_NL) – Rene Polish (pl_PL) – Difreo Brazilian Portuguese (pt_BR) – Caciano Gabriel Russian (ru_RU) – Sonika Swedish (sv_SE) – Pontus Carlsson Turkish (tr_TR) – Omer Faruk Ukranian (uk_UA) – Andrew Kovalev Uzbek (uz_UZ) – Alexandra Bolshova Chinese (zh_CN) – hurri zhu If you have translated into your language, please let me know. Japanese Custom Field Template Manual Are you interested in other plugins? See the following site CMS x WP. Known Issues / Bugs Uninstall Deactivate the plugin That’s it! 🙂

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C