CVE-2025-14056 is a stored cross-site scripting vulnerability in the Custom Post Type UI plugin for WordPress. It occurs due to improper neutralization of input (CWE-79) in the 'label' parameter during the import of custom post types. Authenticated users with administrator privileges can exploit this flaw to inject arbitrary web scripts that execute in the context of users accessing the Tools → Get Code page. The vulnerability affects all versions up to 1.18.1. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, high privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

An attacker with administrator-level access can inject persistent malicious scripts that execute in the browser context of users visiting a specific admin page, potentially leading to unauthorized actions or data exposure within the WordPress admin interface. The impact is limited to confidentiality and integrity, with no direct availability impact. The vulnerability requires high privileges and has a high attack complexity, reducing the likelihood of exploitation by lower-privileged users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and avoid importing untrusted custom post type definitions. Monitor official webdevstudios channels for updates regarding patches or mitigations.