plugin

Custom Post Type Vulnerabilities

1 known security issue reported for the Custom Post Type WordPress plugin. Most recent disclosed Nov 20, 2025.

1 medium

Running Custom Post Type on your site? Check whether your installed version is affected.

Custom Post Type <= 1.0 - Cross-Site Request Forgery to Custom Post Type Deletion

medium

The Custom Post Type plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the custom post type deletion functionality. This makes it possible for unauthenticated attackers to delete custom post types via a forged request g...

CVSS:: 4.3
Affected:: up to 1.0
Fix:: No patched version reported
Disclosed:: Nov 20, 2025

CVE-2025-13142 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database