CVE Database /
CVE-2025-14056
CVE · Medium
CVE-2025-14056 — Custom Post Type UI [custom-post-type-ui] < 1.18.2
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2025-14056
|
Custom Post Type UI [custom-post-type-ui] < 1.18.2 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
4.4
|
< 1.18.2
|
1.18.2 |
2025-12-12 |
—
|
CVE-2025-14056
The Custom Post Type UI plugin for WordPress contains a security flaw in all versions up to 1.18.1, allowing an attacker with Administrator privileges to inject malicious code into certain pages of the site. This vulnerability arises from inadequate filtering of input data and insufficient protection against script injection during custom post type imports. As a result, when users visit the Tools → Get Code page, the injected scripts will execute.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings