CVE-2025-62069
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter. This issue affects MDTF: from n/a through <= 1.3.3.8.
Risk Assessment
XSS attack may allow execution of malicious script in user's browser, theft of session cookies, or account takeover. May lead to website compromise.
Recommendation
Update MDTF plugin to version higher than 1.3.3.8. If update is not possible, consider disabling the plugin.
Other vulnerabilities in MDTF
See all- CVE-2026-54843Critical
There is an unauthenticated SQL injection vulnerability in MDTF versions <= 1.3.7.
- CVE-2025-62964Medium
The MDTF (wp-meta-data-filter-and-taxonomy-filter) plugin for WordPress in versions up to and including 1.3.6 contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables performing operations without the required privileges.
- CVE-2025-49907Medium
The MDTF plugin up to version 1.3.3.9 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized access to functionality.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter.This issue affects MDTF: from n/a through <= 1.3.3.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS