Description

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vars' parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that a published page or post on the target site contains the [meta_data_filter_results] shortcode, which is the primary output feature of the plugin.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-11-06T10:16:35.950Z",
  "pubdate": "2026-11-06T10:16:35.950Z",
  "executiveSummary": "The Meta Data and Taxonomies Filter (MDTF) WordPress plugin is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw exists in versions 1.4.1 and earlier, stemming from improper sanitization of user-supplied data within the 'vars' parameter.\nThe vulnerability allows unauthenticated remote attackers to inject malicious JavaScript into the application, which is then stored and executed in the context of a victim's browser session. Successful exploitation requires a WordPress page or post containing the [meta_data_filter_results] shortcode, as this component serves as the primary output vector for the tainted data.\nThe risk implication is significant, as an attacker can execute arbitrary scripts, leading to potential session hijacking, unauthorized actions on behalf of the user, or defacement of the affected page. Because the vulnerability does not require authentication, the attack surface includes any public-facing installation utilizing the vulnerable shortcode. Immediate remediation is necessary to prevent potential exploitation.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the Meta Data and Taxonomies Filter plugin to implement adequate input validation and output encoding for the 'vars' parameter. When the plugin processes requests, it fails to sanitize the input before storing it, and subsequently neglects to escape the data before rendering it in the DOM via the shortcode output mechanism.\nThe exploitation flow begins with an unauthenticated attacker crafting a malicious payload containing JavaScript, which is then injected into the 'vars' parameter. Because the plugin does not validate this input, the payload is persisted within the application's storage or database. When a target user—which could include a site administrator or a regular site visitor—navigates to a page where the [meta_data_filter_results] shortcode is implemented, the plugin retrieves the malicious payload and renders it directly into the HTML response.\nUpon rendering, the victim's browser interprets the injected script as legitimate code originating from the trusted origin, leading to arbitrary JavaScript execution. The scope of impact is governed by the context of the user viewing the affected page. If an administrator views the page, the injected script may execute with the elevated privileges of that administrator, potentially enabling unauthorized configuration changes, plugin installations, or the creation of new administrative accounts.\nTechnically, the vulnerability is classified as Stored XSS because the payload is permanently stored on the server side and served to any user requesting the affected page. The requirement for the [meta_data_filter_results] shortcode acts as a trigger condition; the plugin's architectural design effectively transforms the stored input into a live execution vector. There are no authentication or privilege requirements for the attacker to initiate this request, as the input processing logic is exposed to the public network. Post-exploitation impact may include the theft of session cookies (if 'HttpOnly' flags are absent), unauthorized modification of the Document Object Model (DOM), or seamless redirection of users to malicious third-party infrastructure."
}