{"id":"CVE-2026-125783","kind":"vulnerability","aliases":["CVE-2026-125783"],"related":[],"title":"WordPress WCK plugin: reflected XSS lets attackers run scripts in browsers","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in madalin.ungureanu Custom Post Types and Custom Fields creator – WCK wck-custom-fields-and-custom-post-types-creator allows Reflected XSS.This issue affects Custom Post Types and Custom Fields creator – WCK: from n/a through 2.4.0.","summary":"The WCK Custom Post Types and Custom Fields creator WordPress plugin has a reflected cross-site scripting flaw. An attacker can make a victim's browser run injected script through a crafted link, affecting versions through 2.4.0.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wck-custom-fields-and-custom-post-types-creator","fixed":["2.4.1"],"affected":"<= 2.4.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","wck-custom-fields-and-custom-post-types-creator","wordpress","xss"],"not_affected_if":["plugin-not-installed","version-2.4.1-or-later"],"how_to_check":"- WordPress admin > Plugins: check the version of 'Custom Post Types and Custom Fields creator – WCK'; 2.4.0 or older is affected.\n- Or read the Version header in wp-content/plugins/wck-custom-fields-and-custom-post-types-creator/ (the main plugin file) or run: wp plugin get wck-custom-fields-and-custom-post-types-creator --field=version","fix":"Update to 2.4.1 or later (2.4.2 is current as of 2026-11-10). The changelog for 2.4.1 lists a reflected XSS fix in the map field; the link to this CVE is inferred.","status":"open","published_at":"2026-11-13T15:17:40+00:00","first_seen_at":"2026-11-13T15:46:17+00:00","triaged_at":"2026-11-13T15:48:33+00:00","updated_at":"2026-11-13T15:49:45+00:00","category":"package","confidence":0.65,"triage":{"at":"2026-11-13T15:48:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress WCK plugin: reflected XSS lets attackers run scripts in browsers","impact":"medium","summary":"The WCK Custom Post Types and Custom Fields creator WordPress plugin has a reflected cross-site scripting flaw. An attacker can make a victim's browser run injected script through a crafted link, affecting versions through 2.4.0.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wck-custom-fields-and-custom-post-types-creator"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs script in a victim's logged-in browser session","analyst_note":"Find the fixed version and the affected endpoint in the NVD entry or the plugin's changelog, since the sources give only 'through 2.4.0'.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or look for the `wck-custom-fields-and-custom-post-types-creator` folder in `wp-content/plugins/`\n- Compare the installed version against the fixed version, which the sources do not state","plain_action":"","product_name":"wck-custom-fields-and-custom-post-types-creator","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WCK Custom Post Types and Custom Fields creator WordPress plugin at version 2.4.0 or earlier are affected. The flaw is reflected, so exposure depends on whether the plugin's vulnerable page echoes user input, which the sources do not describe in detail. Sites that do not run this plugin can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000779,"input_tokens":4587,"output_tokens":640,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version and the affected endpoint in the NVD entry or the plugin's changelog, since the sources give only 'through 2.4.0'.","search":"'-125783':14A,17A '-2026':13A,16A '2.4.0':76B,125C 'affect':73B,113C 'allow':109C 'and':22A 'attack':7A,59B 'browser':11A,65B 'craft':71B 'creator':26A,36B,47B,98C,108C,120C 'cross':54B,86C 'cross-sit':53B,85C 'custom':20A,23A,30B,33B,41B,45B,92C,96C,102C,105C,114C,118C 'cve':12A,15A 'field':31B,46B,97C,103C,119C 'fields':21A 'flaw':57B 'generat':84C 'improp':77C 'inject':67B 'input':80C 'issu':112C 'let':6A 'link':72B 'madalin.ungureanu':91C 'make':61B 'n/a':123C 'neutral':78C 'packag':27B 'page':83C 'plugin':3A,49B 'post':24A,34B,42B,93C,106C,115C 'reflect':4A,52B,110C 'run':8A,66B 'script':9A,56B,68B,88C 'site':55B,87C 'type':35B,43B,94C,107C,116C 'types':25A 'version':74B 'victim':63B 'vulner':89C 'wck':2A,19A,29B,40B,99C,101C,121C 'wck-custom-fields-and-custom-post-types-cr':28B,100C 'wck-custom-fields-and-custom-post-types-creator':18A 'web':82C 'wordpress':1A,37B,48B 'xss':5A,38B 'xss.this':111C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the WCK Custom Post Types and Custom Fields creator plugin at 2.4.0 or older. It is a reflected XSS, so a victim (for example a logged-in admin) has to open a crafted link; the plugin's changelog points to the map field. Sites without the plugin, or on 2.4.1 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["wckcustomfieldsandcustomposttypescreator"],"ptokens":["and","creator","custom","fields","post","types","wck"],"labels":["high","package","vendor","wckcustomfieldsandcustomposttypescreator","wordpress","xss"],"campaign_type":null,"search_a":"'-125783':14A,17A '-2026':13A,16A 'and':22A 'attack':7A 'browser':11A 'creator':26A 'custom':20A,23A 'cve':12A,15A 'fields':21A 'let':6A 'plugin':3A 'post':24A 'reflect':4A 'run':8A 'script':9A 'types':25A 'wck':2A,19A 'wck-custom-fields-and-custom-post-types-creator':18A 'wordpress':1A 'xss':5A","search_b":"'2.4.0':76B 'affect':73B 'attack':59B 'browser':65B 'craft':71B 'creator':36B,47B 'cross':54B 'cross-sit':53B 'custom':30B,33B,41B,45B 'field':31B,46B 'flaw':57B 'inject':67B 'link':72B 'make':61B 'packag':27B 'plugin':49B 'post':34B,42B 'reflect':52B 'run':66B 'script':56B,68B 'site':55B 'type':35B,43B 'version':74B 'victim':63B 'wck':29B,40B 'wck-custom-fields-and-custom-post-types-cr':28B 'wordpress':37B,48B 'xss':38B","search_c":"'2.4.0':125C 'affect':113C 'allow':109C 'creator':98C,108C,120C 'cross':86C 'cross-sit':85C 'custom':92C,96C,102C,105C,114C,118C 'field':97C,103C,119C 'generat':84C 'improp':77C 'input':80C 'issu':112C 'madalin.ungureanu':91C 'n/a':123C 'neutral':78C 'page':83C 'post':93C,106C,115C 'reflect':110C 'script':88C 'site':87C 'type':94C,107C,116C 'vulner':89C 'wck':99C,101C,121C 'wck-custom-fields-and-custom-post-types-cr':100C 'web':82C 'xss.this':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125783","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125783","severity":null,"published_at":"2026-11-13T15:17:40+00:00","modified_at":"2026-11-13T15:17:40+00:00","first_seen_at":"2026-11-13T15:46:17+00:00","fetched_at":"2026-11-13T15:46:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125783:3895","url":"https://wordpress.org/plugins/wck-custom-fields-and-custom-post-types-creator/","severity":null,"published_at":"2026-11-13T15:49:45+00:00","modified_at":"2026-11-13T15:49:45+00:00","first_seen_at":"2026-11-13T15:49:45+00:00","fetched_at":"2026-11-13T15:49:45+00:00","note":"NVD gives only 'through 2.4.0'. Plugin changelog (wordpress.org) lists 2.4.1 'Fix: Reflected XSS issue in the map field' (Patchstack report); 2.4.0 fixed a different one in the upload field. Mapping this CVE to the map-field fix is my inference, not stated by the CVE, so nothing marked verified. 2.4.2 is current. No PoC or exploitation found; no social search done (B tier, low noise).","cites":["https://wordpress.org/plugins/wck-custom-fields-and-custom-post-types-creator/"]}],"documents":[{"id":147274,"url":"https://wordpress.org/plugins/wck-custom-fields-and-custom-post-types-creator/","title":"WCK plugin page and changelog (wordpress.org)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}