CVE-2022-4442: WCK < 2.3.3 - Admin+ Stored XSS

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-01-16 · updated 2026-06-17

Description

The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).

Affected products

Custom Post Types and Custom Fields creator: before 2.3.3 — fixed in 2.3.3

How to fix

Upgrade to a fixed version: Custom Post Types and Custom Fields creator 2.3.3. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/12766537-df59-49d6-815a-4d68265a4c4a
https://wpscan.com/vulnerability/12766537-df59-49d6-815a-4d68265a4c4a

Get alerted when CVE-2022-4442 or the next vulnerability affects your stack