Select All Categories and Taxonomies < 1.3.2 - Reflected Cross-Site Scripting (XSS)
Priority MEDIUM 40CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue
Why it matters now
EPSS 0.10358 95th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Select All Categories and Taxonomies, Change Checkbox to Radio Buttons (Moove Agency): 1.3.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Moove Agency | Select All Categories and Taxonomies, Change Checkbox to Radio Buttons | 1.3.2 to before 1.3.2 | 1.3.2 | Patch available | CNA |
- Select All Categories and Taxonomies, Change Checkbox to Radio Buttons VendorMoove Agency Affected 1.3.2 to before 1.3.2 Fixed in 1.3.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mooveagency:select_all_categories_and_taxonomies\,_change_checkbox_to_radio_buttons:*:*:*:*:*:wordpress:*:* | before 1.3.2 | Vulnerable | Moove Agency |
- cpe:2.3:a:mooveagency:select_all_categories_and_taxonomies\,_change_checkbox_to_radio_buttons:*:*:*:*:*:wordpress:*:* Versions before 1.3.2 Vulnerable ·Moove Agency
Remediation
- Fix · CNA Select All Categories and Taxonomies, Change Checkbox to Radio Buttons (Moove Agency) Fixed in 1.3.2
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24287
- 2026-10-03 Alias added: GHSA-w48f-hvm9-m282
References
Sources
- CVE-2021-24287 · CVE Program
- CVE-2021-24287 · NVD
- FIRST EPSS
- GHSA-w48f-hvm9-m282 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences