Read the docs
TI-2021-06734 Aliases CVE-2021-24444GHSA-8c7r-h373-6jrj

TaxoPress < 3.0.7.2 - Authenticated Stored Cross-Site Scripting (XSS)

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue.

Why it matters now

EPSS 0.02315 83rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed TaxoPress – Create and Manage Taxonomies, Tags, Categories (Unknown): 3.0.7.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownTaxoPress – Create and Manage Taxonomies, Tags, Categories3.0.7.2 to before 3.0.7.23.0.7.2Patch availableCNA
  • TaxoPress – Create and Manage Taxonomies, Tags, Categories VendorUnknown Affected 3.0.7.2 to before 3.0.7.2 Fixed in 3.0.7.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:taxopress:taxopress:*:*:*:*:*:wordpress:*:*before 3.0.7.2Vulnerablestevejburge
  • cpe:2.3:a:taxopress:taxopress:*:*:*:*:*:wordpress:*:* Versions before 3.0.7.2 Vulnerable ·stevejburge

Remediation

  • Fix · CNA TaxoPress – Create and Manage Taxonomies, Tags, Categories (Unknown) Fixed in 3.0.7.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24444
  2. 2026-10-03 Alias added: GHSA-8c7r-h373-6jrj

References

Exploit 1

Advisory 1

  • TI-2025-00527 AI Autotagger < 3.30.0 - Admin+ Stored XSS CVSS 3.1LOW 3.5
  • TI-2025-12211 Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection CVSS 3.1MEDIUM 6.5
  • TI-2023-02036 TaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting CVSS 3.1MEDIUM 5.5
  • TI-2023-02035 TaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting CVSS 3.1MEDIUM 5.5
  • TI-2023-02034 TaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting CVSS 3.1MEDIUM 5.5
  • TI-2025-12207 Missing authorization in stevejburge Tag, Category, and Taxonomy Manager – AI Autotagger… CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences