CVE-2025-46491 Overview
CVE-2025-46491 is a stored Cross-Site Scripting (XSS) vulnerability in the Matthew Muro Multi-Column Taxonomy List plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. It affects all versions of the multi-column-taxonomy-list plugin through version 1.5. An authenticated attacker with low-level privileges can inject persistent JavaScript payloads that execute in the browser of any user who views the affected page. The scope change in the CVSS vector indicates that injected scripts can impact resources beyond the vulnerable component, such as administrator sessions.
Critical Impact
Authenticated attackers can persist malicious JavaScript that executes in victim browsers, enabling session theft, administrative actions on behalf of victims, and defacement of rendered pages.
Affected Products
- Matthew Muro Multi-Column Taxonomy List plugin for WordPress
- All versions from n/a through 1.5
- WordPress sites with the multi-column-taxonomy-list plugin installed and active
Discovery Timeline
- 2025-04-24 - CVE-2025-46491 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-46491
Vulnerability Analysis
The vulnerability is a stored XSS issue in the Multi-Column Taxonomy List plugin. Input supplied to the plugin is written to the database and later rendered in generated HTML without adequate encoding or sanitization. Because the payload persists server-side, it executes every time a victim loads the affected page.
The CVSS vector indicates a network-exploitable weakness that requires low-privileged authentication and user interaction. The scope change component reflects that scripts executing in an administrator's browser can affect resources outside the plugin, including WordPress core administrative functions.
Root Cause
The root cause is missing output escaping and input sanitization in the plugin's rendering code paths. Values controlled by an authenticated user are echoed into page templates without functions such as esc_html(), esc_attr(), or wp_kses() being applied consistently. This allows attacker-controlled markup and script tags to reach the DOM verbatim.
Attack Vector
An attacker with at least contributor-level access submits a payload containing JavaScript into a plugin-controlled field. The payload is stored in the WordPress database. When an administrator or other visitor views the page rendering the multi-column taxonomy list, the browser parses and executes the injected script under the site's origin. Refer to the Patchstack XSS Vulnerability Report for further technical context.
Detection Methods for CVE-2025-46491
Indicators of Compromise
- Taxonomy or plugin-related database entries containing <script> tags, javascript: URIs, or event handlers such as onerror= and onload=.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after visiting pages that render the plugin output.
- New or modified WordPress administrator accounts created without a corresponding legitimate session.
Detection Strategies
- Audit the wp_options, wp_termmeta, and post content tables for HTML or JavaScript syntax in fields associated with the multi-column-taxonomy-list plugin.
- Review web server access logs for POST requests to plugin endpoints containing URL-encoded script payloads.
- Correlate authenticated low-privilege user activity with subsequent administrator sessions exhibiting anomalous behavior.
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to surface inline script violations originating from plugin-rendered pages.
- Monitor WordPress audit logs for changes to plugin settings, user roles, and installed plugins.
- Alert on any addition of administrator accounts or modification of the wp_users table outside normal change windows.
How to Mitigate CVE-2025-46491
Immediate Actions Required
- Deactivate the Multi-Column Taxonomy List plugin until a patched version is available and applied.
- Restrict contributor and author accounts and audit recent submissions for stored script payloads.
- Force password resets for administrator accounts that viewed pages rendering the plugin output during the exposure window.
Patch Information
At the time of publication, versions through 1.5 are affected and no fixed version is listed in the NVD entry. Monitor the Patchstack advisory and the plugin's WordPress.org listing for a security release, and apply it as soon as it becomes available.
Workarounds
- Remove or deactivate the multi-column-taxonomy-list plugin from all WordPress installations.
- Deploy a Web Application Firewall (WAF) rule that blocks requests containing script tags or event-handler attributes targeting the plugin's endpoints.
- Apply a strict Content Security Policy that disallows inline scripts on pages where the plugin renders content.
- Clean the database by removing stored HTML or JavaScript from any plugin-managed fields discovered during the audit.
# Deactivate the vulnerable plugin using WP-CLI
wp plugin deactivate multi-column-taxonomy-list
wp plugin delete multi-column-taxonomy-list
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
