Mb Custom Post Types & Custom Taxonomies
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:mb_custom_post_types_&_custom_taxonomies:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Mb Custom Post Types & Custom Taxonomies (d5d2d478-5cba-5490-9d76-70aabc182e27) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-109982 |
vulnerable | 2026-11-03 10:17:39.469456 |
MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI Migration
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions, allowing any authenticated user, such as a subscriber, to trigger a one-way migration that creates published records and permanently deletes a companion MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2's entire post-type and taxonomy configuration.
Published: 2026-10-16T06:00:14.108Z
Updated: 2026-10-16T14:49:21.095Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-110010 |
vulnerable | 2026-11-03 10:16:01.501384 |
MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Unauthenticated Settings Reset via 'mbcpt-force' Parameter
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from a pre-2.0 release back to its pre-upgrade state. This discards configuration changes an administrator made after upgrading and, where those changes had restricted a definition's visibility, silently re-exposes the definition and its content to anonymous visitors.
Published: 2026-10-22T06:00:17.601Z
Updated: 2026-10-22T11:06:29.431Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-110011 |
vulnerable | 2026-11-03 10:16:01.115149 |
MB Custom Post Types & Custom Taxonomies 2.4.0 - 2.12.2 - Contributor+ Post Type Definition and Non-Public Post Metadata Disclosure via Export
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature, allowing users with a role as low as Contributor to read the configuration of admin-only custom post types and taxonomies, as well as the titles, dates, statuses and some stored content of other users' non-public posts and pages.
Published: 2026-10-22T06:00:17.779Z
Updated: 2026-10-22T11:06:29.278Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-10143 |
vulnerable | 2026-06-08 06:22:03.663330 |
MB Custom Post Types & Custom Taxonomies < 2.7.7 - Admin+ Stored XSS
The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Published: 2025-05-15T20:06:41.435Z
Updated: 2025-05-20T15:49:47.182Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.