CVE-2026-108175
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The MDTF (wp-meta-data-filter-and-taxonomy-filter) plugin by PluginUs.Net contains a Cross-site Scripting vulnerability (improper neutralization of input during web page generation) that allows Stored XSS. This issue affects MDTF from n/a through 1.4.0.
Risk Assessment
A malicious script stored in the application may execute in other users' browsers, enabling session theft or actions on their behalf. This can lead to compromise of privileged accounts.
Recommendation
Update the MDTF plugin to a version later than 1.4.0. Consider deploying Content-Security-Policy headers and sanitizing input.
Other vulnerabilities in MDTF
See all- CVE-2026-54843Critical
There is an unauthenticated SQL injection vulnerability in MDTF versions <= 1.3.7.
- CVE-2026-108151Medium
Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection. This issue affects MDTF from n/a through 1.3.9.
- CVE-2025-62964Medium
The MDTF (wp-meta-data-filter-and-taxonomy-filter) plugin for WordPress in versions up to and including 1.3.6 contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables performing operations without the required privileges.
- CVE-2025-62069Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter. This issue affects MDTF: from n/a through <= 1.3.3.8.
- CVE-2025-49907Medium
The MDTF plugin up to version 1.3.3.9 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized access to functionality.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Stored XSS.This issue affects MDTF: from n/a through 1.4.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS