Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Custom 404 Pro Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 12 vulnerability records associated with Custom 404 Pro, published between 2019 and 2025.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

12Total records
2Critical
2High
8Medium
0Low
0Informational
11Patched records
1Currently marked unpatched
2019-06-24First disclosure
2025-10-10Latest disclosure
11 of 12CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201922 records
202377 records
202411 records
202522 records

Severity Breakdown

SeverityRecordsShare
Critical216.7%
High216.7%
Medium866.7%

Vulnerability-Type Breakdown

Cross-Site Scripting

6 records50%

First: 2019. Latest: 2024.

SQL Injection

4 records33.3%

First: 2023. Latest: 2025.

CSRF

2 records16.7%

First: 2023. Latest: 2025.

Patch Status

Patched
11
Currently marked unpatched
1
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 3.12.1
  • 3.11.2
  • 3.10.1
  • 3.8.2
  • 3.7.3
  • 3.8.1
  • 3.7.2
  • 3.7.1
  • 3.2.9
  • 3.2.8

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-3.12.0Custom 404 Pro <= 3.12.0 - Authenticated (Administrator+) SQL Injection via `path` ParameterOctober 10, 2025Not suppliedMedium
*-3.12.0Custom 404 Pro <= 3.12.0 - Cross-Site Request ForgeryMay 13, 20253.12.1Medium
*-3.11.1Custom 404 Pro <= 3.11.1 - Reflected Cross-Site ScriptingAugust 1, 20243.11.2Medium
*-3.10.0Custom 404 Pro <= 3.10.0 - Unauthenticated Stored Cross-Site Scripting via loggingDecember 27, 20233.10.1High
*-3.8.1Custom 404 Pro <= 3.8.1 - Reflected Cross-Site Scripting via 'page'May 15, 20233.8.2Medium
*-3.7.2Custom 404 Pro <= 3.7.2 - Reflected Cross-Site Scripting via 's'May 2, 20233.7.3Medium
*-3.8.0Custom 404 Pro <= 3.8.0 - Unauthenticated SQL Injection via 's'April 25, 20233.8.1Critical
[*, 3.7.3)Custom 404 Pro <= 3.7.2 - Unauthenticated SQL InjectionApril 25, 20233.7.3Critical
*-3.7.1Custom 404 Pro <= 3.7.1 - Cross-Site Request ForgeryJanuary 18, 20233.7.2Medium
*-3.7.0Custom 404 Pro <= 3.7.0 - Authenticated (Administrator+) SQL InjectionJanuary 13, 20233.7.1High
[*, 3.2.9)Custom 404 Pro <= 3.2.8 - Reflected Cross-Site ScriptingJune 25, 20193.2.9Medium
[*, 3.2.8)Custom 404 Pro <= 3.2.7 - Reflected Cross-Site ScriptingJune 24, 20193.2.8Medium

Selected source records

Latest Records

MediumCVE-2025-9947

Custom 404 Pro <= 3.12.0 - Authenticated (Administrator+) SQL Injection via `path` Parameter

Published: October 10, 2025

Affected versions
*-3.12.0
Patched versions
Not supplied
Original Wordfence record
MediumCVE-2025-62880

Custom 404 Pro <= 3.12.0 - Cross-Site Request Forgery

Published: May 13, 2025

Affected versions
*-3.12.0
Patched versions
3.12.1
Original Wordfence record
MediumCVE-2024-39646

Custom 404 Pro <= 3.11.1 - Reflected Cross-Site Scripting

Published: August 1, 2024

Affected versions
*-3.11.1
Patched versions
3.11.2
Original Wordfence record
HighCVE-2023-51540

Custom 404 Pro <= 3.10.0 - Unauthenticated Stored Cross-Site Scripting via logging

Published: December 27, 2023

Affected versions
*-3.10.0
Patched versions
3.10.1
Original Wordfence record
MediumCVE-2023-32740

Custom 404 Pro <= 3.8.1 - Reflected Cross-Site Scripting via 'page'

Published: May 15, 2023

Affected versions
*-3.8.1
Patched versions
3.8.2
Original Wordfence record
MediumCVE-2023-2023

Custom 404 Pro <= 3.7.2 - Reflected Cross-Site Scripting via 's'

Published: May 2, 2023

Affected versions
*-3.7.2
Patched versions
3.7.3
Original Wordfence record
Critical

Custom 404 Pro <= 3.7.2 - Unauthenticated SQL Injection

Published: April 25, 2023

Affected versions
[*, 3.7.3)
Patched versions
3.7.3
Original Wordfence record
CriticalCVE-2023-2032

Custom 404 Pro <= 3.8.0 - Unauthenticated SQL Injection via 's'

Published: April 25, 2023

Affected versions
*-3.8.0
Patched versions
3.8.1
Original Wordfence record

Highest-Severity Records

Critical

Custom 404 Pro <= 3.7.2 - Unauthenticated SQL Injection

Published: April 25, 2023

Affected versions
[*, 3.7.3)
Patched versions
3.7.3
Original Wordfence record
CriticalCVE-2023-2032

Custom 404 Pro <= 3.8.0 - Unauthenticated SQL Injection via 's'

Published: April 25, 2023

Affected versions
*-3.8.0
Patched versions
3.8.1
Original Wordfence record
HighCVE-2023-51540

Custom 404 Pro <= 3.10.0 - Unauthenticated Stored Cross-Site Scripting via logging

Published: December 27, 2023

Affected versions
*-3.10.0
Patched versions
3.10.1
Original Wordfence record
HighCVE-2022-47605

Custom 404 Pro <= 3.7.0 - Authenticated (Administrator+) SQL Injection

Published: January 13, 2023

Affected versions
*-3.7.0
Patched versions
3.7.1
Original Wordfence record
MediumCVE-2023-2023

Custom 404 Pro <= 3.7.2 - Reflected Cross-Site Scripting via 's'

Published: May 2, 2023

Affected versions
*-3.7.2
Patched versions
3.7.3
Original Wordfence record
MediumCVE-2024-39646

Custom 404 Pro <= 3.11.1 - Reflected Cross-Site Scripting

Published: August 1, 2024

Affected versions
*-3.11.1
Patched versions
3.11.2
Original Wordfence record
MediumCVE-2023-32740

Custom 404 Pro <= 3.8.1 - Reflected Cross-Site Scripting via 'page'

Published: May 15, 2023

Affected versions
*-3.8.1
Patched versions
3.8.2
Original Wordfence record
MediumCVE-2019-15838

Custom 404 Pro <= 3.2.7 - Reflected Cross-Site Scripting

Published: June 24, 2019

Affected versions
[*, 3.2.8)
Patched versions
3.2.8
Original Wordfence record

Currently Marked Unpatched Records

MediumCVE-2025-9947

Custom 404 Pro <= 3.12.0 - Authenticated (Administrator+) SQL Injection via `path` Parameter

Published: October 10, 2025

Affected versions
*-3.12.0
Patched versions
Not supplied
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory