A Cross-Site Scripting (XSS) vulnerability has been discovered in the WordPress Ultimate Taxonomy Manager Plugin. This vulnerability could allow a malicious actor to inject malicious scripts into the affected website, which would be executed when visitors visit the site.

This vulnerability was discovered and reported by thiennv.

The vulnerability is caused by a lack of input validation in the plugin’s code. This allows an attacker to inject malicious scripts into the website, which are then executed when visitors visit the site.

It is important to note that there is currently no patched version of the WordPress Ultimate Taxonomy Manager Plugin available. Therefore, it is important to disable the plugin until a patched version is released.

Severity

The vulnerability has a CVSS 3.1 score of 7.1, which is considered to be high severity. This means that the vulnerability is moderately likely to be exploited and could have a significant impact on the affected system.

Affected Versions

As of the latest information, no patched version is available to address the Cross Site Scripting (XSS) vulnerability in the Ultimate Taxonomy Manager Plugin. This situation requires urgent attention.

Impact

The consequences of this vulnerability are profound:

  • Script Injection: Malicious actors can inject scripts into the affected website, which may be used for unauthorized activities.
  • Visitor Risk: The scripts can affect the website’s visitors, potentially leading to harmful redirects or unwanted content.
  • Site Reputation: An exploited website can suffer damage to its reputation and user trust.

Recommendation

In light of this high-severity vulnerability, swift action is imperative to secure a website. Here are the steps to follow:

  • Deactivate and Delete: Given that no patched version is available, it is recommended to deactivate and delete the Ultimate Taxonomy Manager Plugin immediately. This is a temporary measure to mitigate the risk until a fixed version becomes available.
  • Regularly Update Plugins: As a general practice, keep all WordPress plugins and themes up to date. Regular updates are essential for maintaining a secure website.
  • Enhance Security Measures: Implement additional security measures such as web application firewalls (WAFs), and robust authentication protocols, and perform regular security audits.