Custom Post Type UI
Custom Post Type UI has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2020 and 2025; all 4 are fixed as of September 2026. Their average CVSS score is 5.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (25%). Other recurring categories include Cross-Site Scripting, Exposure Of Sensitive Information To An Unauthorized Actor.
Every one of the 4 issues recorded for Custom Post Type UI has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. Custom Post Type UI is installed on roughly 1,000,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
Custom Post Type UI <= 1.7.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Custom Post Type UI
Author
webdevstudios
Custom Post Type UI provides an easy-to-use interface for registering and managing custom post types and taxonomies for your WordPress website — no coding required. Used by more than 1,000,000 active WordPress sites, CPTUI is the trusted foundation for building structured content in WordPress. Whether you are creating a portfolio, events calendar, product catalog, staff directory, or any other custom content type, CPTUI gives you the tools to define it quickly and correctly. Ready to go further? Meet CPT UI Pro CPTUI handles registration. CPT UI Pro handles everything else. CPT UI Pro is the official premium add-on built by the same WebDevStudios team that created and maintains this plugin. It extends CPTUI into a complete content operations stack — front-end display blocks, admin list table controls, multisite management, and a full developer API. Front-end display tools Ten built-in layout options: Default, List, Single Post Type, Taxonomy List, Post Slider, Post Cards, Featured Plus, Grid, and Grid With Overlay Taxonomy Filter Blocks so visitors can filter content by term Single Post Block Templates to control individual post output Shortcode Builder for reusable, configurable display output Admin list table management Column Builder with drag-and-drop column control for any post type Advanced Filters by taxonomy, meta field, date, author, and status Screen Options Panel for per-user admin table visibility Multisite management Network-level CPT registration from one central location Push config to subsites to keep site structures consistent Per-site inheritance control for flexible network governance Developer-focused workflow cptui_pro_post_types filter to merge, modify, or replace registrations Auto-discovery hooks so themes and plugins can register CPTs without manual setup Programmatic registration API for JSON-driven or CI-driven workflows Extended REST API support on top of core CPTUI REST capabilities Get CPT UI Pro at Pluginize.com Plugin development Custom Post Type UI development is managed on GitHub, with official releases published on WordPress.org. The GitHub repo can be found at https://github.com/WebDevStudios/custom-post-type-ui. Please use the WordPress.org support tab for potential bugs, issues, or enhancement ideas.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C