plugin

Add Custom Fields To Media Vulnerabilities

2 known security issues reported for the Add Custom Fields To Media WordPress plugin. Most recent disclosed Mar 19, 2026.

2 medium

Running Add Custom Fields To Media on your site? Check whether your installed version is affected.

Scan your site free

Add Custom Fields to Media - Cross-Site Request Forgery to Custom Field Deletion via 'delete' Parameter vulnerability

medium

Cross-Site Request Forgery to Custom Field Deletion via 'delete' Parameter vulnerability

CVSS:
4.3
Affected:
up to 2.0.3
Fixed in:
2.0.4
Disclosed:
Mar 19, 2026

Add Custom Fields to Media <= 2.0.3 - Cross-Site Request Forgery to Custom Field Deletion via 'delete' Parameter

medium

The Add Custom Fields to Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.3. This is due to missing nonce validation on the field deletion functionality in the admin display template. The plugin properly validates a nonce for the 'add field' operation (lin...

CVSS:
4.3
Affected:
up to 2.0.3
Fixed in:
2.0.4
Disclosed:
Mar 18, 2026

CVE-2026-4068 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database