CVE-2025-24670: Term Taxonomy Converter XSS Vulnerability

CVE-2025-24670 Overview

CVE-2025-24670 is a reflected Cross-Site Scripting (XSS) vulnerability in the Dhanendran Rajagopal Term Taxonomy Converter plugin for WordPress. The flaw affects all versions up to and including 1.2. The plugin fails to properly neutralize user-supplied input during web page generation, allowing attackers to inject arbitrary JavaScript into responses rendered by the application [CWE-79]. Successful exploitation requires a victim to interact with a crafted URL or request, after which the injected payload executes in the victim's browser session against the WordPress site.

Critical Impact

Attackers can hijack administrator sessions, steal authentication cookies, or perform actions on behalf of authenticated WordPress users by tricking them into clicking a crafted link.

Affected Products

• Dhanendran Rajagopal Term Taxonomy Converter plugin for WordPress
• All versions from initial release through 1.2
• WordPress sites with the term-taxonomy-converter plugin installed and activated

Discovery Timeline

• 2025-04-17 - CVE-2025-24670 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-24670

Vulnerability Analysis

The Term Taxonomy Converter plugin reflects user-controlled input back into HTTP responses without sufficient output encoding or input sanitization. When a user submits a request containing JavaScript payloads through a vulnerable parameter, the plugin echoes that input directly into the rendered HTML. The browser then parses the injected script as legitimate page content and executes it within the WordPress origin.

The vulnerability is classified as reflected XSS, meaning the payload is not stored on the server. Each exploitation attempt requires user interaction, typically delivered through phishing emails, malicious links, or attacker-controlled web pages. Because the scope is changed (S:C in the CVSS vector), the injected script can affect resources beyond the vulnerable component, including the broader WordPress administration context.

Root Cause

The plugin lacks proper application of WordPress sanitization functions such as esc_html(), esc_attr(), or sanitize_text_field() on input parameters before output. This violates secure coding practices for WordPress plugin development, where any data placed into HTML context must be escaped according to its destination.

Attack Vector

An attacker crafts a URL containing a malicious JavaScript payload in a vulnerable parameter handled by the plugin. The attacker delivers the URL to an authenticated WordPress user, often a site administrator. When the victim loads the URL, the plugin reflects the payload into the response and the browser executes it. The script can then exfiltrate session cookies, perform privileged actions through the WordPress REST API, or modify site content. Refer to the Patchstack Vulnerability Advisory for technical details.

Detection Methods for CVE-2025-24670

Indicators of Compromise

• HTTP requests to Term Taxonomy Converter plugin endpoints containing <script>, javascript:, onerror=, or URL-encoded equivalents in query parameters.
• Unexpected administrator account creation, plugin installations, or theme modifications following access to plugin URLs.
• Outbound requests from administrator browsers to unfamiliar domains shortly after visiting WordPress admin pages.

Detection Strategies

• Inspect web server access logs for requests to term-taxonomy-converter paths containing reflected script payloads or HTML metacharacters.
• Deploy a Web Application Firewall (WAF) with signatures tuned to identify reflected XSS attempts targeting WordPress plugins.
• Correlate referer headers from phishing domains with subsequent administrator activity in WordPress audit logs.

Monitoring Recommendations

• Enable WordPress audit logging to track plugin and user changes initiated from administrator sessions.
• Monitor browser security telemetry for Content Security Policy (CSP) violations on WordPress admin pages.
• Alert on anomalous REST API calls authenticated as administrators originating from unusual user-agent strings or IP addresses.

How to Mitigate CVE-2025-24670

Immediate Actions Required

• Deactivate and remove the Term Taxonomy Converter plugin until a patched version is confirmed available.
• Force a password reset for all WordPress administrator accounts and invalidate active sessions.
• Audit recent administrative actions, including user creation, plugin installations, and content changes.

Patch Information

No fixed version is referenced in the NVD record at the time of publication. The advisory states the vulnerability affects Term Taxonomy Converter through version 1.2. Site operators should consult the Patchstack Vulnerability Advisory for current patch status and replace the plugin with a maintained alternative if no fix is released.

Workarounds

• Remove the plugin entirely if business operations do not require its functionality.
• Restrict access to the WordPress administrative interface using IP allowlisting at the web server or WAF layer.
• Deploy a strict Content Security Policy that disallows inline script execution on WordPress pages.
• Train administrators to avoid clicking unsolicited links targeting the WordPress backend.

# Example: remove the vulnerable plugin via WP-CLI
wp plugin deactivate term-taxonomy-converter
wp plugin delete term-taxonomy-converter