Cross-site Scripting Vulnerability in WCK Custom Post Types and Fields by Madalin Ungureanu
CVE-2026-125783

7.1HIGH

Key Information:

Vendor

WordPress
Status
Custom Post Types And Custom Fields Creator – Wck
Vendor
CVE Published:
13 November 2026

What is CVE-2026-125783?

The WCK Custom Post Types and Custom Fields creator by Madalin Ungureanu is susceptible to a Cross-site Scripting (XSS) vulnerability. This flaw allows an attacker to inject malicious scripts into web pages viewed by unsuspecting users, potentially compromising user data and leading to unauthorized actions. The issue has been confirmed in version 2.4.0 and requires immediate attention to safeguard against potential exploits.

Affected Version(s)

Custom Post Types and Custom Fields creator – WCK 0 <= 2.4.0

References

https://patchstack.com/database/wordpress/plugin/wck-cust...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Viet Tin | Patchstack Bug Bounty Program
.