CVE-2025-14056

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14056", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-04T17:52:11.237Z", "datePublished": "2025-12-13T03:20:25.501Z", "dateUpdated": "2026-04-08T17:05:24.591Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:05:24.591Z"}, "affected": [{"vendor": "webdevstudios", "product": "Custom Post Type UI", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.18.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Custom Post Type UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'label' parameter during custom post type import in all versions up to, and including, 1.18.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses the Tools \u2192 Get Code page."}], "title": "Custom Post Type UI <= 1.18.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'label' Import Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/890c743e-da5e-46ed-a011-cecd24778163?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-post-type-ui/trunk/inc/tools-sections/tools-post-types.php#L201"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-post-type-ui/tags/1.18.1/inc/tools-sections/tools-post-types.php#L201"}, {"url": "https://github.com/WebDevStudios/custom-post-type-ui/pull/1014/files#diff-bd3331205024f12a78d74b312bc4f5ad118b5734999bf53a4a95e0959891f60a"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "M Indra Purnama"}], "timeline": [{"time": "2025-12-04T18:07:58.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-12T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T15:43:56.863142Z", "id": "CVE-2025-14056", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:49:09.743Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14056", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T15:43:56.863142Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:43:57.885Z"}}], "cna": {"title": "Custom Post Type UI <= 1.18.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'label' Import Parameter", "credits": [{"lang": "en", "type": "finder", "value": "M Indra Purnama"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "webdevstudios", "product": "Custom Post Type UI", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.18.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-04T18:07:58.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-12T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/890c743e-da5e-46ed-a011-cecd24778163?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-post-type-ui/trunk/inc/tools-sections/tools-post-types.php#L201"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-post-type-ui/tags/1.18.1/inc/tools-sections/tools-post-types.php#L201"}, {"url": "https://github.com/WebDevStudios/custom-post-type-ui/pull/1014/files#diff-bd3331205024f12a78d74b312bc4f5ad118b5734999bf53a4a95e0959891f60a"}], "descriptions": [{"lang": "en", "value": "The Custom Post Type UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'label' parameter during custom post type import in all versions up to, and including, 1.18.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses the Tools \u2192 Get Code page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:05:24.591Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14056", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:05:24.591Z", "dateReserved": "2025-12-04T17:52:11.237Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-13T03:20:25.501Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Custom Post Type UI", "vendor": "webdevstudios", "versions": [{"lessThanOrEqual": "1.18.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Custom Post Type UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'label' parameter during custom post type import in all versions up to, and including, 1.18.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses the Tools \u2192 Get Code page."}, {"lang": "es", "value": "El plugin Custom Post Type UI para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del par\u00e1metro 'label' durante la importaci\u00f3n de tipos de entrada personalizados en todas las versiones hasta la 1.18.1, inclusive, debido a una sanitizaci\u00f3n de entrada insuficiente y un escape de salida inadecuado. Esto permite a atacantes autenticados, con acceso de nivel de Administrador, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a la p\u00e1gina Herramientas ? Obtener c\u00f3digo."}], "id": "CVE-2025-14056", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14056", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T15:43:56.863142Z", "version": "2.0.3"}}]}, "published": "2025-12-13T16:16:47.900", "references": [{"source": "security@wordfence.com", "url": "https://github.com/WebDevStudios/custom-post-type-ui/pull/1014/files#diff-bd3331205024f12a78d74b312bc4f5ad118b5734999bf53a4a95e0959891f60a"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/custom-post-type-ui/tags/1.18.1/inc/tools-sections/tools-post-types.php#L201"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/custom-post-type-ui/trunk/inc/tools-sections/tools-post-types.php#L201"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/890c743e-da5e-46ed-a011-cecd24778163?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:16:41.702552+00:00", "value": {"mitigation_remediation": ["Upgrade Custom Post Type UI to a version newer than 1.18.1 (any released patch that removes the unsanitized import path).", "If an upgrade is not immediately possible, disable or restrict the plugin\u2019s import functionality to trusted administrators or remove the \"label\" field from import forms.", "Audit existing custom post types for injected scripts and manually cleanse any malicious code from the label attribute before the page is served to users."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all releases of the Custom Post Type UI WordPress plugin up to and including version 1.18.1. Any WordPress installation employing this plugin without a later patch is at risk.", "description_and_impact": "The Custom Post Type UI plugin for WordPress is vulnerable to stored cross\u2011site scripting through the \"label\" parameter used during custom post type import. Because the plugin does not sanitize or escape this input, an authenticated user with Administrator privileges can inject arbitrary JavaScript that will be executed whenever a site visitor opens the Tools \u2192 Get Code page. This flaw allows an attacker to run client\u2011side code in the victim\u2019s browser, potentially leading to credential compromise, defacement, or further malicious activity.", "risk_and_exploitability": "The CVSS score of 4.4 indicates moderate severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The flaw is not listed in CISA\u2019s KEV catalog and requires an authenticated Administrator to perform the injection. Because the malicious code is stored and only executed when a user accesses a specific plugin page, the risk is primarily to users who trigger that page after an administrator has imported a malicious label. Overall, the threat is moderate but present for sites still running the affected plugin version."}}}}, "created": "2025-12-14T21:14:46.086197+00:00", "updated": "2026-04-21T17:30:37.684354+00:00", "vendors": ["webdevstudios", "webdevstudios$PRODUCT$custom_post_type_ui", "wordpress", "wordpress$PRODUCT$wordpress"]}