CVE-2025-22338
Published: 07 January 2025
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lich_wang WP-tagMaker tagmaker allows Reflected XSS.This issue affects WP-tagMaker: from n/a through <= 0.2.2.
Security Summary
CVE-2025-22338 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the WP-tagMaker plugin (also known as tagmaker) by lich_wang for WordPress. The issue impacts all versions from n/a through 0.2.2, as published on 2025-01-07.
The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it is exploitable remotely over the network with low complexity and no required privileges, though it necessitates user interaction. Attackers can deliver malicious payloads via reflected inputs on web pages generated by the plugin, potentially achieving low-level impacts on confidentiality, integrity, and availability within a changed security scope.
Patchstack documents this Reflected XSS vulnerability in their database entry for the WordPress WP-tagMaker plugin version 0.2.2.
Details
- CWE(s)