{
 "id": "WPSEC-2026-2998",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2998/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2998/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2998/index.md",
 "title": "Custom Post Types and Custom Fields creator – WCK <= 2.4.0 - Reflected Cross-Site Scripting via 'postedvalues' Parameter",
 "description": "The WCK plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'postedvalues' parameter in all versions up to, and including, 2.4.0. This is due to the base64-encoded posted values being read from the URL into single meta box forms, and map marker values being printed into an HTML attribute without escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can trick a user, such as an administrator, into clicking a crafted link. Exploitation requires a single meta box with a map field and a configured Google Maps API key.",
 "plugin": {
  "slug": "wck-custom-fields-and-custom-post-types-creator",
  "name": "Custom Post Types and Custom Fields creator – WCK",
  "full_name": "Custom Post Types and Custom Fields creator – WCK",
  "wordpress_org": "https://wordpress.org/plugins/wck-custom-fields-and-custom-post-types-creator/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wck-custom-fields-and-custom-post-types-creator/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wck-custom-fields-and-custom-post-types-creator"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.2.9",
    "from_inclusive": true,
    "to": "2.4.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.2.9 before 2.4.1"
  ]
 },
 "introduced_in": "1.2.9",
 "fixed_in": "2.4.1",
 "remediation": "Update to 2.4.1 or later.",
 "fix_released": "2026-11-10T08:51:06+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:15:37.489786+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2998/",
  "https://plugins.svn.wordpress.org/wck-custom-fields-and-custom-post-types-creator/tags/2.4.1/",
  "https://wordpress.org/plugins/wck-custom-fields-and-custom-post-types-creator/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wck-custom-fields-and-custom-post-types-creator",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}