CVE-2025-31767

WordPress Post Custom Templates Lite plugin <= 1.14 - Stored Cross Site Scripting (XSS) vulnerability

Published Apr 1, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Post Custom Templates Lite post-custom-templates-lite allows Stored XSS.This issue affects Post Custom Templates Lite: from n/a through <= 1.14.

Analysis

Technical impact

The vulnerability in OTWthemes Post Custom Templates Lite allows attackers to inject malicious script code that is automatically stored and served with subsequent page views. This stored cross‑site scripting flaw can enable attackers to deface content, steal user session cookies, or perform phishing attacks against site visitors. The weakness belongs to CWE‑79, a classic example of input that is not properly neutralized before rendering.

Affected Systems

WordPress sites that have OTWthemes Post Custom Templates Lite installed at version 1.14 or earlier are affected. Any installation using this plugin without upgrading to a patched release is at risk.

Risk and Exploitability

The vulnerability has a CVSS score of 6.5, indicating moderate severity, while an EPSS score of less than 1% suggests a low probability of widespread exploitation at present. It is not listed in the CISA KEV catalog. The description does not specify an attack vector; however, it can be reasonably inferred that any user capable of submitting post content to the website could use that interface to inject malicious scripts, which will then be rendered for all visitors.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OTWthemes

Post Custom Templates Lite

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.14

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Post Custom Templates Lite to the latest version (1.15 or later) where the stored XSS flaw is fixed.
If an immediate upgrade is not feasible, configure the plugin or the hosting environment to enforce strict sanitization on post content—e.g., use WordPress’s wp_kses or similar filters—and disable the plugin’s content‑generation features until the patch can be applied.
Audit all existing posts for injected JavaScript, remove or sanitize any suspicious code, and monitor site visitors for anomalous script execution as a potential exploitation indicator.

Generated by OpenCVE AI on May 1, 2026 at 02:18 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-9255	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Post Custom Templates Lite allows Stored XSS. This issue affects Post Custom Templates Lite: from n/a through 1.14.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.368% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/post-custom-templates-lite/vulnerability/wordpress-post-custom-templates-lite-plugin-1-14-stored-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Apr 23, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`

Apr 1, 2026 11:45 PM Description updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Post Custom Templates Lite allows Stored XSS. This issue affects Post Custom Templates Lite: from n/a through 1.14.	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Post Custom Templates Lite post-custom-templates-lite allows Stored XSS.This issue affects Post Custom Templates Lite: from n/a through <= 1.14.
References	https://patchstack.com/database/wordpress/plugin/post-custom-templates-lite/vulnerability/wordpress-post-custom-templates-lite-plugin-1-14-stored-cross-site-scripting-xss-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/post-custom-templates-lite/vulnerability/wordpress-post-custom-templates-lite-plugin-1-14-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`

Apr 1, 2025 6:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 1, 2025 3:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Post Custom Templates Lite allows Stored XSS. This issue affects Post Custom Templates Lite: from n/a through 1.14.
Title		WordPress Post Custom Templates Lite plugin <= 1.14 - Stored Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/post-custom-templates-lite/vulnerability/wordpress-post-custom-templates-lite-plugin-1-14-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`