CVE-2025-13354: falha de média gravidade em stevejburge Tag, Category, and Taxonomy…
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Taxonomy Term Manipulation
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.3%
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.40.1. This is due to the plugin not properly verifying that a user is authorized to perform an action in the "taxopress_merge_terms_batch" function. This makes it possible for authenticated attackers, with subscriber level access and above, to merge or delete arbitrary taxonomy terms.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVEs relacionadas — stevejburge Tag, Category, and Taxonomy…
No mesmo produto, das mais perigosas para as menos.
CVE-2023-2168MEDIUMTaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2023-2170MEDIUMTaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2023-2169MEDIUMTaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-2830MEDIUMWordPress Tag and Category Manager – AI Autotagger <= 3.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2025-13359MEDIUMTag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL InjectionEPSS 0.4%CVE-2025-11972MEDIUMTag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.0 - Authenticated (Editor+) SQL InjectionEPSS 0.3%