CVE-2025-14056

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-14056

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-14056.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-14056

Published

2025-12-13T03:20:25Z

Modified

2026-08-12T03:51:46Z

Severity

4.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Custom Post Type UI <= 1.18.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'label' Import Parameter

Details

The Custom Post Type UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'label' parameter during custom post type import in all versions up to, and including, 1.18.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses the Tools → Get Code page.

Database specific

{
    "cna_assigner": "Wordfence",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14056.json"
}

References

Affected packages

Git / github.com/webdevstudios/custom-post-type-ui

Affected ranges

Type

GIT

Repo

https://github.com/webdevstudios/custom-post-type-ui

Events

Introduced

Last Affected

215779a5ac0c624f0dcf875e87305b4898d5bcf9

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.18.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*

0.8.1

0.9.0

1.*

1.0.0

1.0.1

1.0.2

1.0.4

1.0.5

1.0.7

1.0.8

1.1

1.1.1

1.1.2

1.1.3

1.10.0

1.10.1

1.10.2

1.11.0

1.11.1

1.11.2

1.12.0

1.12.1

1.13.0

1.13.1

1.13.2

1.13.3

1.13.4

1.13.5

1.13.6

1.13.7

1.14.0

1.15.0

1.15.1

1.16.0

1.17.0

1.17.1

1.17.2

1.17.3

1.18.0

1.18.1

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.3.0

1.3.1

1.3.2

1.3.3

1.4.0

1.4.1

1.5.0

1.5.1

1.6.1

1.7.0

1.7.1

1.7.2

1.7.4

1.7.5

1.8.0

1.8.1

1.8.2

1.9.0

1.9.1

1.9.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-14056.json"