CVE-2025-22338: WP-tagMaker Plugin XSS Vulnerability

CVE-2025-22338 Overview

CVE-2025-22338 is a reflected cross-site scripting (XSS) vulnerability in the WP-tagMaker (tagmaker) WordPress plugin developed by lich_wang. The flaw stems from improper neutralization of user-controlled input during web page generation [CWE-79]. All plugin versions up to and including 0.2.2 are affected. An attacker can craft a malicious link that, when clicked by an authenticated or unauthenticated user, executes arbitrary JavaScript in the victim's browser session.

Critical Impact

Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser, potentially stealing session tokens, hijacking accounts, or redirecting users to attacker-controlled infrastructure.

Affected Products

• WP-tagMaker (tagmaker) WordPress plugin versions through 0.2.2
• WordPress sites running the vulnerable plugin
• Browsers rendering reflected attacker-supplied payloads on affected pages

Discovery Timeline

• 2025-01-07 - CVE-2025-22338 published to the National Vulnerability Database (NVD)
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-22338

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the WP-tagMaker plugin. The plugin echoes attacker-controlled input back into a rendered HTTP response without sufficient encoding or sanitization. Because the script payload is reflected directly into HTML output, browsers parse and execute it within the origin of the WordPress site.

Reflected XSS requires user interaction, typically following a crafted link from email, chat, or a malicious page. The scope is marked as changed, indicating the executed script can affect resources beyond the vulnerable component, such as cookies, DOM data, or other plugin contexts on the same origin.

The EPSS probability is approximately 0.112% (percentile 29.14), reflecting low observed exploitation activity at this time, though reflected XSS in WordPress plugins is commonly weaponized in mass phishing campaigns.

Root Cause

The root cause is missing output encoding on a request parameter consumed by the plugin. Developer-supplied code writes the parameter into HTML context without applying WordPress sanitization helpers such as esc_html(), esc_attr(), or wp_kses(). As a result, characters like <, >, and " pass through unmodified and break out of the intended HTML or attribute context.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL containing a JavaScript payload targeting the vulnerable plugin endpoint. The victim must click the link or visit a page that triggers the request. Upon rendering, the injected script executes under the WordPress site's origin, with access to cookies not flagged HttpOnly and the ability to issue authenticated requests on behalf of the victim.

No authentication is required to send the malicious link. Privileged victims, such as administrators, escalate the impact because the script runs with their session context. See the Patchstack WordPress Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-22338

Indicators of Compromise

• HTTP requests to WordPress endpoints associated with the tagmaker plugin containing URL-encoded <script> tags, javascript: URIs, or HTML event handlers such as onerror= and onload=
• Referrer headers pointing to attacker-controlled domains or shortened URLs preceding suspicious plugin requests
• WordPress access logs showing query strings with characters like %3Cscript%3E, %22, or %27 directed at tagmaker paths

Detection Strategies

• Inspect WordPress access logs and WAF telemetry for reflected payload patterns targeting tagmaker plugin parameters
• Deploy Content Security Policy (CSP) report-only mode to surface inline script execution violations originating from plugin pages
• Correlate authentication anomalies, such as new admin sessions or password changes, with prior clicks on links to the vulnerable plugin

Monitoring Recommendations

• Enable verbose logging on the WordPress front-end and reverse proxy to capture full request URIs and bodies
• Alert on outbound browser requests from administrator workstations to unknown domains shortly after WordPress page loads
• Track plugin inventory and flag any WordPress instance running WP-tagMaker at version 0.2.2 or earlier

How to Mitigate CVE-2025-22338

Immediate Actions Required

• Identify all WordPress installations using the WP-tagMaker (tagmaker) plugin and verify installed versions
• Deactivate and remove the plugin until a patched release is confirmed available from the maintainer
• Force a password reset for WordPress administrators who may have clicked untrusted links referencing the plugin

Patch Information

As of the last NVD update on 2026-04-23, the advisory references versions through 0.2.2 as affected and does not list a fixed release. Administrators should consult the Patchstack WordPress Vulnerability Report for the latest remediation status and remove the plugin if no patched version is available.

Workarounds

• Uninstall the WP-tagMaker plugin until the vendor publishes a fixed version
• Deploy a web application firewall rule that blocks requests to the tagmaker plugin paths containing HTML or script metacharacters
• Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
• Configure session cookies with HttpOnly and SameSite=Strict attributes to reduce session theft impact

# Example WAF rule (ModSecurity) blocking reflected XSS payloads against tagmaker endpoints
SecRule REQUEST_URI "@contains /wp-content/plugins/tagmaker/" \
    "chain,phase:2,deny,status:403,id:1002338,msg:'Block reflected XSS attempt against WP-tagMaker (CVE-2025-22338)'"
    SecRule ARGS|QUERY_STRING "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:urlDecodeUni,t:lowercase"