CVE-2023-28664 in Meta Data and Taxonomies Filter Plugin
Summary
by MITRE • 03/22/2023
The Meta Data and Taxonomies Filter WordPress plugin, in versions < 1.3.1, is affected by a reflected cross-site scripting vulnerability in the 'tax_name' parameter of the mdf_get_tax_options_in_widget action, which can only be triggered by an authenticated user.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 12/07/2025
The vulnerability identified as CVE-2023-28664 affects the Meta Data and Taxonomies Filter WordPress plugin, specifically targeting versions prior to 1.3.1. This issue represents a reflected cross-site scripting vulnerability that exploits the 'tax_name' parameter within the mdf_get_tax_options_in_widget action. The security flaw resides in how the plugin processes user input through this particular parameter, creating an avenue for malicious code execution within the context of a victim's browser. The vulnerability requires authentication to be exploited, which means that an attacker must first obtain valid user credentials to leverage this weakness, although the impact remains significant given the privileged nature of the affected functionality.
The technical implementation of this vulnerability stems from insufficient input validation and output sanitization within the plugin's handling of the tax_name parameter. When an authenticated user interacts with the widget functionality that utilizes this action, the plugin fails to properly escape or filter the input data before incorporating it into dynamic web content. This omission allows an attacker to inject malicious scripts that will execute in the browser context of other users who view the affected pages. The reflected nature of the vulnerability indicates that the malicious payload is embedded in a request and reflected back to the user's browser, making it particularly challenging to detect and prevent through traditional security measures.
From an operational perspective, this vulnerability poses a substantial risk to WordPress installations using the affected plugin version. The requirement for authentication limits the attack surface but does not eliminate the threat, as authenticated attackers can potentially escalate privileges or compromise user sessions. The vulnerability can be exploited to perform various malicious activities including session hijacking, credential theft, or redirection to malicious websites. Given that this affects a plugin that handles taxonomy filtering, the attack could potentially impact how content is displayed or how users interact with categorized content, potentially leading to data exfiltration or unauthorized modifications to the website's presentation layer. The vulnerability aligns with CWE-79, which specifically addresses cross-site scripting flaws, and could be categorized under ATT&CK technique T1566 for social engineering attacks that leverage web-based vulnerabilities.
The mitigation strategy for this vulnerability involves immediate upgrading to version 1.3.1 or later, which contains the necessary patches to address the reflected XSS issue. Administrators should also implement additional security measures such as monitoring for suspicious user activities and ensuring that all WordPress installations maintain current plugin versions. Regular security audits should be conducted to identify any other potentially vulnerable components within the WordPress ecosystem. The vulnerability demonstrates the importance of input validation and output escaping practices in web applications, particularly for plugins that handle user-provided data in dynamic contexts. Organizations should also consider implementing web application firewalls and content security policies to provide additional defense-in-depth measures against similar reflected XSS vulnerabilities.