¿Es seguro Custom Post Type Ui?

Qué hace este plugin

• Slug: custom-post-type-ui
• 1000000+ instalaciones activas

content typescustom post typespost typetaxonomytypes

Estado de mantenimiento

• Última versión conocida: 1.19.3
• Requiere PHP: 7.4+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

3 CVEs conocidos registrados para Custom Post Type Ui. Reportadas entre 2020 y 2025.

CVE-2025-14056

The Custom Post Type UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'label' parameter during custom post type import in all versions up to, and including, 1.18.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses the Tools → Get Code page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-12826

The Custom Post Type UI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.18.0. This is due to the plugin not verifying that a user has the required capability to perform actions in the "cptui_process_post_type" function. This makes it possible for authenticated attackers, with subscriber level access and above, to add, edit, or delete custom post types in limited situations.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Custom Post Type UI [custom-post-type-ui] < 1.13.5

Update the WordPress Custom Post Type UI plugin to the latest available version (at least 1.13.5). Unknown discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Custom Post Type UI Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 1.13.5.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-1623

The Custom Post Type UI for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.13.4 . This is due to missing or incorrect nonce validation in the cptui_render_debuginfo_section function. This makes it possible for unauthenticated attackers to exfiltrate debug information gathered by the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The information contains a list of installed and activated themes and plugins, version information for PHP, MySQL and Web Server.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Custom Post Type UI [custom-post-type-ui] < 1.7.4

The Custom Post Type UI plugin for WordPress is vulnerable to Cross-Site Request forgery in versions up to, and including 1.7.3, due missing nonce validation on the import functionality that makes it possible for attackers to trick site administrators into performing unwanted actions such as importing new post types containing malicious web scripts.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Custom Post Type UI [custom-post-type-ui] < 1.7.4

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) discovered in WordPress Custom Post Type UI plugin (versions <= 1.7.3).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Custom Post Type UI [custom-post-type-ui] < 1.7.4

The Custom Post Type UI WordPress plugin was vulnerable to Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS) within the "Import Post Types" functionality in the "Tools" tab. This functionality allows users to import "Post Types" from other websites, or from backup, as JSON. This could allow an attacker to execute arbitrary JavaScript in a victim's browser, if the attacker could entice the authenticated victim to visit a page they controlled. If successfully exploited, this vulnerability could lead to full site compromise.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Custom Post Type Ui actualizado — 1.19.3 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Meta Box — 500000+ instalaciones activas — 96/100 (164) — PHP máx. 8.4
• Pods – Custom Content Types and Fields — 100000+ instalaciones activas — 96/100 (418) — PHP máx. 8.4
• Sydney Toolbox — 50000+ instalaciones activas — 46/100 (15) — PHP máx. 8.4
• CMS Tree Page View – Reorder Pages with a Drag-and-Drop Tree — 50000+ instalaciones activas — 98/100 (361)
• Essential Content Types — 20000+ instalaciones activas — 74/100 (3)