CVE-2025-0627low

CVE-2025-0627: low-severity vulnerability in WordPress Tag, Category, and Taxonomy Manager

AI Autotagger < 3.30.0 - Admin+ Stored XSS

Published

Follow this CVE+ Monitor Tag, Category, and Taxonomy Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.5epss 0.3%
The WordPress Tag, Category, and Taxonomy Manager WordPress plugin before 3.30.0 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Affected products
Unknown · WordPress Tag, Category, and Taxonomy Manager