CVE-2025-46491

CVSS 3.1 Score 6.5 of 10 (medium)

Details

Published Apr 24, 2025
Updated: Apr 29, 2025
CWE ID 79

Summary

CVE-2025-46491 is a Cross-site Scripting (XSS) vulnerability affecting the Multi-Column Taxonomy List plugin for WordPress. The flaw, named Stored XSS, is due to improper neutralization of user input during web page generation. Successful exploitation enables attackers to inject malicious scripts into a webpage viewed by other users. Affected versions of the plugin range from not available to 1.5. Users are advised to update to the latest version or consider alternative solutions to mitigate the risk.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share