CVE-2025-46502: LSD Custom Taxonomy CSRF Vulnerability

CVE-2025-46502 Overview

CVE-2025-46502 is a Cross-Site Scripting (XSS) vulnerability chained with Cross-Site Request Forgery (CSRF) in the Bas Matthee LSD Custom Taxonomy and Category Meta WordPress plugin. The flaw affects all versions up to and including 1.3.2. Attackers can trick authenticated administrators into executing forged requests that inject malicious scripts into taxonomy or category metadata fields. The injected payload executes in the browser context of users viewing the affected pages, enabling session theft, account takeover, and administrative action abuse. The vulnerability is tracked under CWE-79.

Critical Impact

An unauthenticated attacker can leverage CSRF to inject persistent JavaScript into WordPress taxonomy fields, leading to script execution in administrator browsers and potential full site compromise.

Affected Products

• Bas Matthee LSD Custom Taxonomy and Category Meta plugin (custom-taxonomy-category-and-term-fields)
• All versions from n/a through 1.3.2
• WordPress installations using the affected plugin

Discovery Timeline

• 2025-04-24 - CVE-2025-46502 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-46502

Vulnerability Analysis

The vulnerability combines two weaknesses: missing CSRF protection on taxonomy and term metadata update handlers, and improper neutralization of user input during web page generation. The plugin extends WordPress taxonomy and category screens with custom meta fields but fails to validate request authenticity through nonces or origin checks. It also stores and renders submitted field values without sufficient output encoding.

An attacker hosts a crafted page containing an auto-submitting form or fetch request targeting the plugin's term update endpoint. When an authenticated administrator visits the attacker-controlled page, the browser submits the forged request using the admin's active WordPress session. The plugin accepts the request and persists the attacker-supplied JavaScript into the database.

The stored payload renders without proper escaping when administrators or visitors load taxonomy management screens or front-end pages displaying the meta values. The required user interaction reflects the need for the victim to visit the attacker-controlled page.

Root Cause

The root cause is the absence of WordPress nonce verification (wp_verify_nonce or check_admin_referer) on the plugin's term metadata save handlers, combined with missing sanitization via sanitize_text_field on input and esc_attr or esc_html on output. Input flows from request parameters directly into stored term meta and then into HTML responses without neutralization.

Attack Vector

Exploitation requires network access and victim interaction. An attacker delivers a malicious link or embeds a hidden form on an external site. When a logged-in WordPress administrator follows the link or loads the page, the browser silently submits the CSRF payload. The injected script then executes whenever the affected taxonomy data is rendered, allowing the attacker to perform actions in the administrator's authenticated session.

No verified public proof-of-concept code is available. Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-46502

Indicators of Compromise

• Unexpected <script> tags, onerror handlers, or javascript: URIs stored in WordPress wp_termmeta table entries associated with the plugin
• Outbound HTTP requests from administrator browser sessions to unfamiliar domains following navigation to taxonomy screens
• New or modified WordPress administrator accounts created shortly after admin sessions visited external links
• Web server access logs showing POST requests to taxonomy edit endpoints with missing or invalid _wpnonce parameters

Detection Strategies

• Audit the wp_termmeta table for entries containing HTML or JavaScript syntax in fields managed by the plugin
• Inspect referer headers on taxonomy update POST requests for cross-origin sources inconsistent with administrator workflow
• Deploy a web application firewall rule to flag POST requests to /wp-admin/edit-tags.php and /wp-admin/term.php that lack valid nonce tokens

Monitoring Recommendations

• Enable WordPress audit logging to record term and taxonomy modifications with user, timestamp, and source IP
• Monitor administrator account activity for anomalous content changes immediately after external browsing sessions
• Alert on creation of privileged WordPress users or modification of wp_options entries outside change windows

How to Mitigate CVE-2025-46502

Immediate Actions Required

• Deactivate the LSD Custom Taxonomy and Category Meta plugin until a patched version is released by the maintainer
• Review all taxonomy and term metadata for previously injected script content and remove malicious entries
• Force password resets and session invalidation for all WordPress administrator accounts
• Restrict administrator browsing of untrusted external sites during active WordPress sessions

Patch Information

No fixed version has been published at the time of this advisory. The vulnerability affects all releases up to and including version 1.3.2. Monitor the Patchstack advisory and the plugin's WordPress.org page for patch availability.

Workarounds

• Remove the plugin entirely if taxonomy meta functionality is not business-critical
• Deploy a Content Security Policy (CSP) restricting inline script execution on WordPress admin and front-end pages
• Enforce SameSite=Strict cookies for WordPress authentication to reduce CSRF exposure
• Apply web application firewall rules requiring valid nonce parameters on all wp-admin POST requests

# Disable the affected plugin via WP-CLI
wp plugin deactivate custom-taxonomy-category-and-term-fields
wp plugin delete custom-taxonomy-category-and-term-fields

# Audit term meta for suspicious content
wp db query "SELECT meta_id, term_id, meta_key, meta_value FROM wp_termmeta WHERE meta_value REGEXP '<script|onerror=|javascript:';"