Custom Global Variables
Custom Global Variables has one disclosed vulnerability in the WordSec catalog, all reported in 2021; it is fixed as of September 2026. Their average CVSS score is 5.5, and the most serious one scores 5.5 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Custom Global Variables has a vendor fix available, so running the current release closes it.
All of these findings were reported by swapnil subhash bodekar. Custom Global Variables is installed on roughly 5,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.1.12.
CVE-2021-3124Custom Global Variables <= 1.0.5 - Stored Cross-Site Scripting via 'name'
Read the full analysisVulnerability Records
Custom Global Variables
Author
akirak
Create your own custom variables to manage information on your website such as: Phone numbers Addresses Social media links HTML snippets And anything else test Easily access them globally in WordPress and PHP. Why you need it Rather than having to change something like an email address across multiple pages, you can do it in one place. Avoid the pitfalls of hard coding information in your WordPress theme that is likely to change. Why it’s better Your variables are stored and retrieved locally without any calls to the database. That means faster load times for your pages! Variables can be accessed easily in PHP from the global scope. Usage Display your variables using the shortcode syntax: [cgv variable-name] Or using the superglobal in PHP: <?php echo $GLOBALS['cgv']['variable-name'] ?>
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C