WordPress plugin
Multiple Post Type Order security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High0
- Medium1
- Low0
All Multiple Post Type Order vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcode ≤1.10.0No patch available | CVE-2025-4055 |
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcode
≤1.10.0No patch available
Multiple Post Type Order: common questions
Does Multiple Post Type Order have known vulnerabilities?
Yes. VulnCrest Radar lists 1 known vulnerability in Multiple Post Type Order: 1 medium. At least one is not fixed in the latest version.
How do I check which version of Multiple Post Type Order I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Multiple Post Type Order vulnerability?
CVE-2025-4055, published May 6, 2025: Multiple Post Type Order <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcode. Severity: Medium (CVSS 6.4).
Is any Multiple Post Type Order vulnerability listed in CISA KEV?
No. None of the known Multiple Post Type Order vulnerabilities is currently listed in the CISA KEV catalog.