TI-2026-52002 CVE-2026-74012 · GHSA-wrmm-h8g9-2g7g
WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability
Priority MEDIUM 41
Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection.
Vulnerabilities
13 records
TI-2025-13129 CVE-2025-14371 · GHSA-69m7-6xqg-m79v
TaxoPress <= 3.41.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Tag Modification
Priority LOW 19
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the taxopress_ai_add_post_term function in…
TI-2025-12724 CVE-2025-13922 · GHSA-jmrr-6c39-fwgp
SQL injection in stevejburge Tag, Category, and Taxonomy Manager – AI Autotagger with…
Priority LOW 31
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'existing_terms_orderby' parameter in the AI preview AJAX endpoint in all v…
TI-2025-12211 CVE-2025-13359 · GHSA-q5c3-w3j7-4hxr
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection
Priority LOW 29
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based SQL Injection via the "getTermsForAjax" function in all versions up to, and including, 3.40.1.
TI-2025-12207 CVE-2025-13354 · GHSA-vpf5-h5rh-88hf
Missing authorization in stevejburge Tag, Category, and Taxonomy Manager – AI Autotagger…
Priority LOW 20
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.40.1.
TI-2025-10976 CVE-2025-11972 · GHSA-6mgg-q6v6-jm65
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.0 - Authenticated (Editor+) SQL Injection
Priority LOW 22
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'post_types' parameter in all versions up to, and including, 3.40.0 due to insufficient esca…
TI-2025-00527 CVE-2025-0627 · GHSA-4p64-hxgr-8p2m
AI Autotagger < 3.30.0 - Admin+ Stored XSS
Priority MEDIUM 50
The WordPress Tag, Category, and Taxonomy Manager WordPress plugin before 3.30.0 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Sit…
TI-2022-04562 CVE-2022-4974 · GHSA-p5fp-r7v7-h5q7
Freemius SDK <= 2.4.2 - Missing Authorization Checks
Priority LOW 28
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_de…
TI-2024-02640 CVE-2024-2830 · GHSA-957v-72q7-mwww
Cross-site scripting in stevejburge Tag, Category, and Taxonomy Manager – AI Autotagger…
Priority LOW 29
The WordPress Tag and Category Manager – AI Autotagger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'st_tag_cloud' shortcode in all versions up to, and including, 3.13.0 due to insuf…
TI-2023-02036 CVE-2023-2170 · GHSA-7449-82rg-56m7
TaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting
Priority LOW 25
The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping.
TI-2023-02035 CVE-2023-2169 · GHSA-h666-c425-pp7x
TaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting
Priority LOW 25
The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping.
TI-2023-02034 CVE-2023-2168 · GHSA-7774-p5v6-hf2q
TaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting
Priority LOW 25
The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Suggest Terms Title field in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping.
TI-2021-06734 CVE-2021-24444 · GHSA-8c7r-h373-6jrj
TaxoPress < 3.0.7.2 - Authenticated Stored Cross-Site Scripting (XSS)
Priority LOW 27
The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when t…