CVE-2025-14057
Stored XSS in Multi-column Tag Map Plugin for WordPress Multisite
Publication date: 2026-01-07
Last updated on: 2026-01-07
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordfence | multi-column-tag-map | to 17.0.39 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Multi-column Tag Map plugin for WordPress. It occurs because the plugin does not properly sanitize input or escape output in its admin settings. Authenticated users with administrator-level permissions or higher can inject malicious scripts that will execute whenever a user visits the affected page. This vulnerability affects multi-site WordPress installations and those where the unfiltered_html setting is disabled.
How can this vulnerability impact me? :
The vulnerability allows attackers with administrator-level access to inject malicious scripts into pages. These scripts can execute in the context of users visiting those pages, potentially leading to unauthorized actions, data theft, or session hijacking. Since it requires high privileges and affects multi-site setups or those with unfiltered_html disabled, the impact is limited but can compromise site integrity and user security.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that your WordPress installation is not using the Multi-column Tag Map plugin version 17.0.39 or earlier. Update the plugin to a version where this vulnerability is fixed. Additionally, restrict administrator-level permissions to trusted users only, and consider enabling unfiltered_html if it is safe to do so in your environment. For multi-site installations, review and sanitize admin settings inputs carefully to prevent stored cross-site scripting.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the WordPress installation uses the multi-column Tag Map plugin version 17.0.39 or earlier, especially in multi-site setups or where unfiltered_html is disabled. Since the vulnerability involves stored Cross-Site Scripting via the plugin's admin settings page, detection involves verifying if malicious scripts have been injected into the plugin's stored options, particularly in the 'mctm_css_custom' or 'mctm_css_conditional' fields. You can inspect the WordPress database options table for suspicious or unexpected CSS or HTML code in the 'mctagmapoptions' option. For example, using WP-CLI or direct SQL queries: 1. Using WP-CLI: wp option get mctagmapoptions 2. Using SQL: SELECT option_value FROM wp_options WHERE option_name = 'mctagmapoptions'; Review the output for any injected scripts or unusual CSS/HTML content. Additionally, monitoring HTTP responses for injected scripts on pages where the plugin outputs CSS can help detect exploitation. There are no specific network commands provided, but inspecting the plugin version and stored options is key. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.