CVE-2026-125783: WordPress Custom Post Types and Custom Fields creator – WCK plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The vulnerability is remotely reachable and requires no attacker privileges, but exploitation requires user interaction. It is a reflected XSS issue, so a victim would need to interact with attacker-controlled content or a crafted request.

Q: Which installations may be affected?

Installations using the WordPress Custom Post Types and Custom Fields creator – WCK plugin are affected through version 2.4.0. The available data does not identify a fixed version or any configuration prerequisite.

Q: What is the likely impact if exploitation succeeds?

Successful exploitation may allow limited impact to confidentiality, integrity, and availability, and the impact can extend beyond the vulnerable component because the scope is changed.

Published Nov 13, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in madalin.ungureanu Custom Post Types and Custom Fields creator – WCK wck-custom-fields-and-custom-post-types-creator allows Reflected XSS.This issue affects Custom Post Types and Custom Fields creator – WCK: from n/a through 2.4.0.

Affected Software

1 affected component

wordpress/wck-custom-fields-and-custom-post-types-creator<=2.4.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/wck-custom-fields-and-custom-post-types-creator to a version that resolves this vulnerability.
Fixed in 2.4.2

Event History

Nov 13, 2026

CVE Published

via MITRE·03:08 PM

Data Sourced

via MITRE·03:08 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The vulnerability is remotely reachable and requires no attacker privileges, but exploitation requires user interaction. It is a reflected XSS issue, so a victim would need to interact with attacker-controlled content or a crafted request.

Which installations may be affected?

Installations using the WordPress Custom Post Types and Custom Fields creator – WCK plugin are affected through version 2.4.0. The available data does not identify a fixed version or any configuration prerequisite.

What is the likely impact if exploitation succeeds?

Successful exploitation may allow limited impact to confidentiality, integrity, and availability, and the impact can extend beyond the vulnerable component because the scope is changed.

CVE-2026-125783: WordPress Custom Post Types and Custom Fields creator – WCK plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which installations may be affected?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which installations may be affected?

What is the likely impact if exploitation succeeds?