---
id: "CVE-2026-125783"
page: "https://infrastack.ai/live/CVE-2026-125783"
kind: "vulnerability"
aliases: ["CVE-2026-125783"]
title: "WordPress WCK plugin: reflected XSS lets attackers run scripts in browsers"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "wck-custom-fields-and-custom-post-types-creator", "fixed": ["2.4.1"], "affected": "<= 2.4.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["package", "wck-custom-fields-and-custom-post-types-creator", "wordpress", "xss"]
not_affected_if: ["plugin-not-installed", "version-2.4.1-or-later"]
published_at: "2026-11-13T15:17:40+00:00"
first_seen_at: "2026-11-13T15:46:17+00:00"
updated_at: "2026-11-13T15:49:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125783", "first_seen_at": "2026-11-13T15:46:17+00:00"}, {"source": "analyst", "url": "https://wordpress.org/plugins/wck-custom-fields-and-custom-post-types-creator/", "first_seen_at": "2026-11-13T15:49:45+00:00", "cites": ["https://wordpress.org/plugins/wck-custom-fields-and-custom-post-types-creator/"]}]
exploit_sources: []
---

# WordPress WCK plugin: reflected XSS lets attackers run scripts in browsers

Link for people: https://infrastack.ai/live/CVE-2026-125783 (this .md is for agents)

The WCK Custom Post Types and Custom Fields creator WordPress plugin has a reflected cross-site scripting flaw. An attacker can make a victim's browser run injected script through a crafted link, affecting versions through 2.4.0.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:wck-custom-fields-and-custom-post-types-creator affected <= 2.4.0 fixed 2.4.1

## How to check

- WordPress admin > Plugins: check the version of 'Custom Post Types and Custom Fields creator – WCK'; 2.4.0 or older is affected.
- Or read the Version header in wp-content/plugins/wck-custom-fields-and-custom-post-types-creator/ (the main plugin file) or run: wp plugin get wck-custom-fields-and-custom-post-types-creator --field=version

## Fix

Update to 2.4.1 or later (2.4.2 is current as of 2026-11-10). The changelog for 2.4.1 lists a reflected XSS fix in the map field; the link to this CVE is inferred.

## Timeline

- 2026-11-13T15:46:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125783
- 2026-11-13T15:49:45+00:00 analyst https://wordpress.org/plugins/wck-custom-fields-and-custom-post-types-creator/ — NVD gives only 'through 2.4.0'. Plugin changelog (wordpress.org) lists 2.4.1 'Fix: Reflected XSS issue in the map field' (Patchstack report); 2.4.0 fixed a different one in the upload field. Mapping this CVE to the map-field fix is my inference, not stated by the CVE, so nothing marked verified. 2.4.2 is current. No PoC or exploitation found; no social search done (B tier, low noise).

## Documents

- [fix] WCK plugin page and changelog (wordpress.org) https://wordpress.org/plugins/wck-custom-fields-and-custom-post-types-creator/

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in madalin.ungureanu Custom Post Types and Custom Fields creator – WCK wck-custom-fields-and-custom-post-types-creator allows Reflected XSS.This issue affects Custom Post Types and Custom Fields creator – WCK: from n/a through 2.4.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_