CVE-2026-108175: WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Stored XSS.This issue affects MDTF: from n/a through 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filterto a version that resolves this vulnerability.Fixed in 1.4.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs network access, low-privileged access to the affected WordPress site, and a user to interact with the attacker-controlled content. The impact can extend beyond the attacker's original privileges because the vulnerability is scoped as changed.
Which MDTF versions are affected?
MDTF versions through 1.4.0 are affected. The available data does not identify a fixed version.
What is the potential impact of successful exploitation?
Successful exploitation can result in limited disclosure of information, modification of data, and denial of service. Because this is stored XSS, malicious script content may persist in generated web content and execute when viewed by another user.