The SentinelOne Annual Threat Report - A Defenders Guide from the FrontlinesThe SentinelOne Annual Threat ReportGet the Report
Experiencing a Breach?Blog
Get StartedContact Us
SentinelOne
  • Platform
    Platform Overview
    • Singularity Platform
      Welcome to Integrated Enterprise Security
    • AI for Security
      Leading the Way in AI-Powered Security Solutions
    • Securing AI
      Accelerate AI Adoption with Secure AI Tools, Apps, and Agents.
    • How It Works
      The Singularity XDR Difference
    • Singularity Marketplace
      One-Click Integrations to Unlock the Power of XDR
    • Pricing & Packaging
      Comparisons and Guidance at a Glance
    Data & AI
    • Purple AI
      Accelerate SecOps with Generative AI
    • Singularity Hyperautomation
      Easily Automate Security Processes
    • AI-SIEM
      The AI SIEM for the Autonomous SOC
    • AI Data Pipelines
      Security Data Pipeline for AI SIEM and Data Optimization
    • Singularity Data Lake
      AI-Powered, Unified Data Lake
    • Singularity Data Lake for Log Analytics
      Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
    Endpoint Security
    • Singularity Endpoint
      Autonomous Prevention, Detection, and Response
    • Singularity XDR
      Native & Open Protection, Detection, and Response
    • Singularity RemoteOps Forensics
      Orchestrate Forensics at Scale
    • Singularity Threat Intelligence
      Comprehensive Adversary Intelligence
    • Singularity Vulnerability Management
      Application & OS Vulnerability Management
    • Singularity Identity
      Identity Threat Detection and Response
    Cloud Security
    • Singularity Cloud Security
      Block Attacks with an AI-Powered CNAPP
    • Singularity Cloud Native Security
      Secure Cloud and Development Resources
    • Singularity Cloud Workload Security
      Real-Time Cloud Workload Protection Platform
    • Singularity Cloud Data Security
      AI-Powered Threat Detection for Cloud Storage
    • Singularity Cloud Security Posture Management
      Detect and Remediate Cloud Misconfigurations
    Securing AI
    • Prompt Security
      Secure AI Tools Across Your Enterprise
  • Why SentinelOne?
    Why SentinelOne?
    • Why SentinelOne?
      Cybersecurity Built for What’s Next
    • Our Customers
      Trusted by the World’s Leading Enterprises
    • Industry Recognition
      Tested and Proven by the Experts
    • About Us
      The Industry Leader in Autonomous Cybersecurity
    Compare SentinelOne
    • Arctic Wolf
    • Broadcom
    • CrowdStrike
    • Cybereason
    • Microsoft
    • Palo Alto Networks
    • Sophos
    • Splunk
    • Trellix
    • Trend Micro
    • Wiz
    Verticals
    • Energy
    • Federal Government
    • Finance
    • Healthcare
    • Higher Education
    • K-12 Education
    • Manufacturing
    • Retail
    • State and Local Government
  • Services
    Managed Services
    • Managed Services Overview
      Wayfinder Threat Detection & Response
    • Threat Hunting
      World-Class Expertise and Threat Intelligence
    • Managed Detection & Response
      24/7/365 Expert MDR Across Your Entire Environment
    • Incident Readiness & Response
      DFIR, Breach Readiness, & Compromise Assessments
    Support, Deployment, & Health
    • Technical Account Management
      Customer Success with Personalized Service
    • SentinelOne GO
      Guided Onboarding & Deployment Advisory
    • SentinelOne University
      Live and On-Demand Training
    • Services Overview
      Comprehensive Solutions for Seamless Security Operations
    • SentinelOne Community
      Community Login
  • Partners
    Our Network
    • MSSP Partners
      Succeed Faster with SentinelOne
    • Singularity Marketplace
      Extend the Power of S1 Technology
    • Cyber Risk Partners
      Enlist Pro Response and Advisory Teams
    • Technology Alliances
      Integrated, Enterprise-Scale Solutions
    • SentinelOne for AWS
      Hosted in AWS Regions Around the World
    • Channel Partners
      Deliver the Right Solutions, Together
    • SentinelOne for Google Cloud
      Unified, Autonomous Security Giving Defenders the Advantage at Global Scale
    • Partner Locator
      Your Go-to Source for Our Top Partners in Your Region
    Partner Portal→
  • Resources
    Resource Center
    • Case Studies
    • Data Sheets
    • eBooks
    • Reports
    • Videos
    • Webinars
    • Whitepapers
    • Events
    View All Resources→
    Blog
    • Feature Spotlight
    • For CISO/CIO
    • From the Front Lines
    • Identity
    • Cloud
    • macOS
    • SentinelOne Blog
    Blog→
    Tech Resources
    • SentinelLABS
    • Ransomware Anthology
    • Cybersecurity 101
  • About
    About SentinelOne
    • About SentinelOne
      The Industry Leader in Cybersecurity
    • Investor Relations
      Financial Information & Events
    • SentinelLABS
      Threat Research for the Modern Threat Hunter
    • Careers
      The Latest Job Opportunities
    • Press & News
      Company Announcements
    • Cybersecurity Blog
      The Latest Cybersecurity Threats, News, & More
    • FAQ
      Get Answers to Our Most Frequently Asked Questions
    • DataSet
      The Live Data Platform
    • S Foundation
      Securing a Safer Future for All
    • S Ventures
      Investing in the Next Generation of Security, Data and AI
  • Pricing
Get StartedContact Us
CVE Vulnerability Database
Vulnerability Database/CVE-2025-46502

CVE-2025-46502: LSD Custom Taxonomy CSRF Vulnerability

CVE-2025-46502 is a Cross Site Request Forgery flaw in LSD Custom taxonomy and category meta plugin that could allow attackers to perform unauthorized actions. This article covers technical details, affected versions, and mitigation.

Updated: May 15, 2026

CVE-2025-46502 Overview

CVE-2025-46502 is a Cross-Site Scripting (XSS) vulnerability chained with Cross-Site Request Forgery (CSRF) in the Bas Matthee LSD Custom Taxonomy and Category Meta WordPress plugin. The flaw affects all versions up to and including 1.3.2. Attackers can trick authenticated administrators into executing forged requests that inject malicious scripts into taxonomy or category metadata fields. The injected payload executes in the browser context of users viewing the affected pages, enabling session theft, account takeover, and administrative action abuse. The vulnerability is tracked under CWE-79.

Critical Impact

An unauthenticated attacker can leverage CSRF to inject persistent JavaScript into WordPress taxonomy fields, leading to script execution in administrator browsers and potential full site compromise.

Affected Products

  • Bas Matthee LSD Custom Taxonomy and Category Meta plugin (custom-taxonomy-category-and-term-fields)
  • All versions from n/a through 1.3.2
  • WordPress installations using the affected plugin

Discovery Timeline

  • 2025-04-24 - CVE-2025-46502 published to NVD
  • 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-46502

Vulnerability Analysis

The vulnerability combines two weaknesses: missing CSRF protection on taxonomy and term metadata update handlers, and improper neutralization of user input during web page generation. The plugin extends WordPress taxonomy and category screens with custom meta fields but fails to validate request authenticity through nonces or origin checks. It also stores and renders submitted field values without sufficient output encoding.

An attacker hosts a crafted page containing an auto-submitting form or fetch request targeting the plugin's term update endpoint. When an authenticated administrator visits the attacker-controlled page, the browser submits the forged request using the admin's active WordPress session. The plugin accepts the request and persists the attacker-supplied JavaScript into the database.

The stored payload renders without proper escaping when administrators or visitors load taxonomy management screens or front-end pages displaying the meta values. The required user interaction reflects the need for the victim to visit the attacker-controlled page.

Root Cause

The root cause is the absence of WordPress nonce verification (wp_verify_nonce or check_admin_referer) on the plugin's term metadata save handlers, combined with missing sanitization via sanitize_text_field on input and esc_attr or esc_html on output. Input flows from request parameters directly into stored term meta and then into HTML responses without neutralization.

Attack Vector

Exploitation requires network access and victim interaction. An attacker delivers a malicious link or embeds a hidden form on an external site. When a logged-in WordPress administrator follows the link or loads the page, the browser silently submits the CSRF payload. The injected script then executes whenever the affected taxonomy data is rendered, allowing the attacker to perform actions in the administrator's authenticated session.

No verified public proof-of-concept code is available. Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-46502

Indicators of Compromise

  • Unexpected <script> tags, onerror handlers, or javascript: URIs stored in WordPress wp_termmeta table entries associated with the plugin
  • Outbound HTTP requests from administrator browser sessions to unfamiliar domains following navigation to taxonomy screens
  • New or modified WordPress administrator accounts created shortly after admin sessions visited external links
  • Web server access logs showing POST requests to taxonomy edit endpoints with missing or invalid _wpnonce parameters

Detection Strategies

  • Audit the wp_termmeta table for entries containing HTML or JavaScript syntax in fields managed by the plugin
  • Inspect referer headers on taxonomy update POST requests for cross-origin sources inconsistent with administrator workflow
  • Deploy a web application firewall rule to flag POST requests to /wp-admin/edit-tags.php and /wp-admin/term.php that lack valid nonce tokens

Monitoring Recommendations

  • Enable WordPress audit logging to record term and taxonomy modifications with user, timestamp, and source IP
  • Monitor administrator account activity for anomalous content changes immediately after external browsing sessions
  • Alert on creation of privileged WordPress users or modification of wp_options entries outside change windows

How to Mitigate CVE-2025-46502

Immediate Actions Required

  • Deactivate the LSD Custom Taxonomy and Category Meta plugin until a patched version is released by the maintainer
  • Review all taxonomy and term metadata for previously injected script content and remove malicious entries
  • Force password resets and session invalidation for all WordPress administrator accounts
  • Restrict administrator browsing of untrusted external sites during active WordPress sessions

Patch Information

No fixed version has been published at the time of this advisory. The vulnerability affects all releases up to and including version 1.3.2. Monitor the Patchstack advisory and the plugin's WordPress.org page for patch availability.

Workarounds

  • Remove the plugin entirely if taxonomy meta functionality is not business-critical
  • Deploy a Content Security Policy (CSP) restricting inline script execution on WordPress admin and front-end pages
  • Enforce SameSite=Strict cookies for WordPress authentication to reduce CSRF exposure
  • Apply web application firewall rules requiring valid nonce parameters on all wp-admin POST requests
bash
# Disable the affected plugin via WP-CLI
wp plugin deactivate custom-taxonomy-category-and-term-fields
wp plugin delete custom-taxonomy-category-and-term-fields

# Audit term meta for suspicious content
wp db query "SELECT meta_id, term_id, meta_key, meta_value FROM wp_termmeta WHERE meta_value REGEXP '<script|onerror=|javascript:';"

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

  • Vulnerability Details
  • TypeCSRF

  • Vendor/TechLsd Custom Taxonomy

  • SeverityHIGH

  • CVSS Score7.1

  • EPSS Probability0.18%

  • Known ExploitedNo
  • CVSS Vector
  • CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
  • Impact Assessment
  • ConfidentialityLow
  • IntegrityLow
  • AvailabilityLow
  • CWE References
  • CWE-79
  • Technical References
  • Patchstack WordPress Vulnerability Report
  • Latest CVEs
  • CVE-2026-46333: Linux Kernel Privilege Escalation Flaw

  • CVE-2026-2586: Eclipse Glassfish RCE Vulnerability

  • CVE-2026-2587: Eclipse Glassfish RCE Vulnerability

  • CVE-2026-45255: FreeBSD bsdinstall/bsdconfig RCE Flaw
Default Legacy - Prefooter | Experience the World’s Most Advanced Cybersecurity Platform

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne
  • Get Started
  • Get a Demo
  • Product Tour
  • Why SentinelOne
  • Pricing & Packaging
  • FAQ
  • Contact
  • Contact Us
  • Customer Support
  • SentinelOne Status
  • Language
  • Platform
  • Singularity Platform
  • Singularity Endpoint
  • Singularity Cloud
  • Singularity AI-SIEM
  • Singularity Identity
  • Singularity Marketplace
  • Purple AI
  • Services
  • Wayfinder TDR
  • SentinelOne GO
  • Technical Account Management
  • Support Services
  • Verticals
  • Energy
  • Federal Government
  • Finance
  • Healthcare
  • Higher Education
  • K-12 Education
  • Manufacturing
  • Retail
  • State and Local Government
  • Cybersecurity for SMB
  • Resources
  • Blog
  • Labs
  • Case Studies
  • Videos
  • Product Tours
  • Events
  • Cybersecurity 101
  • eBooks
  • Webinars
  • Whitepapers
  • Press
  • News
  • Ransomware Anthology
  • Company
  • About Us
  • Our Customers
  • Careers
  • Partners
  • Legal & Compliance
  • Security & Compliance
  • Investor Relations
  • S Foundation
  • S Ventures

©2026 SentinelOne, All Rights Reserved.

Privacy Notice Terms of Use

English