WordPress Plugin Vulnerabilities

TaxoPress < 3.4.5 - Reflected Cross-Site Scripting

Description

The plugin does not escape some generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting

Proof of Concept

Affects Plugins

Plugin icon
simple-tags
Fixed in 3.4.5

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
b5509e79-1f17-48be-afcb-26329112dd9f

Timeline

Publicly Published
2022-02-07 (about 4 years ago)
Added
2022-06-07 (about 3 years ago)
Last Updated
2022-06-07 (about 3 years ago)

Other

Published
Title
Published
2022-07-31
Title
Fast Flow < 1.2.13 - Admin+ Stored Cross-Site Scripting
Published
2023-02-23
Title
WPMobile.App < 11.19 - Admin+ Stored XSS
Published
2025-08-25
Title
Tripadvisor Shortcode <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2025-02-21
Title
WordPress Photo Gallery – Image Gallery <= 2.0.4 - Reflected Cross-Site Scripting
Published
2025-01-07
Title
Mind Doodle Visual Sitemaps & Tasks <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting