{"id":"CVE-2026-110776","kind":"vulnerability","aliases":["CVE-2026-110776"],"related":[],"title":"MDTF WordPress plugin: unauthenticated stored XSS through the vars parameter","description":"The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vars' parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that a published page or post on the target site contains the [meta_data_filter_results] shortcode, which is the primary output feature of the plugin.","summary":"The MDTF Meta Data and Taxonomies Filter plugin for WordPress does not sanitize the 'vars' parameter, so attackers can store scripts that run in visitors' browsers. An unauthenticated attacker can inject script into a page that displays the plugin's shortcode, and it runs whenever a user opens that page.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wp-meta-data-filter-and-taxonomy-filter","fixed":["1.4.2"],"affected":"<= 1.4.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["mdtf","package","unauthenticated","web-frontend","wordpress","wordpress-plugin","xss"],"not_affected_if":["plugin-1.4.2-or-newer","plugin-newer-than-1.4.1","plugin-not-installed","shortcode-not-used"],"how_to_check":"- Check whether the plugin is installed and its version is `1.4.1` or older in the WordPress admin under Plugins.\n- Search published posts and pages for the shortcode `[meta_data_filter_results]`.","fix":"Update the MDTF plugin (wp-meta-data-filter-and-taxonomy-filter) to 1.4.2 or newer.","status":"open","published_at":"2026-11-06T10:16:35+00:00","first_seen_at":"2026-11-06T10:40:56+00:00","triaged_at":"2026-11-06T10:41:17+00:00","updated_at":"2026-11-06T10:42:29+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-06T10:41:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"MDTF WordPress plugin: unauthenticated stored XSS through the vars parameter","impact":"medium","summary":"The MDTF Meta Data and Taxonomies Filter plugin for WordPress does not sanitize the 'vars' parameter, so attackers can store scripts that run in visitors' browsers. An unauthenticated attacker can inject script into a page that displays the plugin's shortcode, and it runs whenever a user opens that page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mdtf","web-frontend"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker scripts run in visitors' browsers, stealing sessions or actions","analyst_note":"Confirm a fixed plugin version from the vendor or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-110776 since no fix is stated.","how_to_check":"- Check whether the plugin is installed and its version is `1.4.1` or older in the WordPress admin under Plugins.\n- Search published posts and pages for the shortcode `[meta_data_filter_results]`.\n- unknown for a fixed version, as the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","shortcode-not-used","plugin-newer-than-1.4.1"],"who_is_affected":"Sites running the MDTF plugin at version 1.4.1 or older that publish a page or post containing the [meta_data_filter_results] shortcode. Sites without the plugin or without that shortcode on a published page are not exposed through this flaw.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000748,"input_tokens":4326,"output_tokens":630,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm a fixed plugin version from the vendor or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-110776 since no fix is stated.","search":"'-110776':13A,16A '-2026':12A,15A '1.4.1':115C 'access':144C 'and':22A 'arbitrari':133C 'attack':53B,64B,130C 'browser':61B 'contain':160C 'cross':101C 'cross-sit':100C 'cve':11A,14A 'data':20A,39B,89C,163C 'display':72B 'due':116C 'escap':123C 'execut':140C 'featur':172C 'filter':21A,24A,42B,92C,164C 'frontend':30B 'includ':114C 'inject':66B,132C,146C 'input':119C 'insuffici':118C 'make':125C 'mdtf':1A,25B,37B,87C 'meta':19A,38B,88C,162C 'open':83B 'output':122C,171C 'packag':26B 'page':70B,85B,137C,147C,153C 'paramet':10A,51B,107C 'plugin':3A,34B,43B,74B,93C,175C 'possibl':127C 'post':155C 'primari':170C 'publish':152C 'requir':149C 'result':165C 'run':58B,79B 'sanit':48B,120C 'script':56B,67B,103C,135C 'shortcod':76B,166C 'site':102C,159C 'store':5A,55B,99C 'target':158C 'taxonomi':41B,91C 'taxonomy':23A 'unauthent':4A,27B,63B,129C 'user':82B,143C 'var':9A,50B,106C 'version':110C 'via':104C 'visitor':60B 'vulner':97C 'web':29B,134C 'web-frontend':28B 'whenev':80B,141C 'wordpress':2A,31B,33B,45B,95C 'wordpress-plugin':32B 'wp':18A 'wp-meta-data-filter-and-taxonomy-filter':17A 'xss':6A,35B","nicknames":[],"mitigations":[],"who_affected":"Sites running the MDTF plugin at version 1.4.1 or older that publish a page or post containing the [meta_data_filter_results] shortcode. Sites without the plugin or without that shortcode on a published page are not exposed through this flaw.","tier":"B","verified":{"fix":{"at":"2026-11-06T10:42:29Z","by":"analyst","doc":"https://wordpress.org/plugins/wp-meta-data-filter-and-taxonomy-filter/","run_id":1883}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["wpmetadatafilterandtaxonomyfilter"],"ptokens":["and","data","filter","meta","taxonomy","wp"],"labels":["high","mdtf","package","unauthenticated","webfrontend","wordpress","wordpressplugin","xss"],"campaign_type":null,"search_a":"'-110776':13A,16A '-2026':12A,15A 'and':22A 'cve':11A,14A 'data':20A 'filter':21A,24A 'mdtf':1A 'meta':19A 'paramet':10A 'plugin':3A 'store':5A 'taxonomy':23A 'unauthent':4A 'var':9A 'wordpress':2A 'wp':18A 'wp-meta-data-filter-and-taxonomy-filter':17A 'xss':6A","search_b":"'attack':53B,64B 'browser':61B 'data':39B 'display':72B 'filter':42B 'frontend':30B 'inject':66B 'mdtf':25B,37B 'meta':38B 'open':83B 'packag':26B 'page':70B,85B 'paramet':51B 'plugin':34B,43B,74B 'run':58B,79B 'sanit':48B 'script':56B,67B 'shortcod':76B 'store':55B 'taxonomi':41B 'unauthent':27B,63B 'user':82B 'var':50B 'visitor':60B 'web':29B 'web-frontend':28B 'whenev':80B 'wordpress':31B,33B,45B 'wordpress-plugin':32B 'xss':35B","search_c":"'1.4.1':115C 'access':144C 'arbitrari':133C 'attack':130C 'contain':160C 'cross':101C 'cross-sit':100C 'data':89C,163C 'due':116C 'escap':123C 'execut':140C 'featur':172C 'filter':92C,164C 'includ':114C 'inject':132C,146C 'input':119C 'insuffici':118C 'make':125C 'mdtf':87C 'meta':88C,162C 'output':122C,171C 'page':137C,147C,153C 'paramet':107C 'plugin':93C,175C 'possibl':127C 'post':155C 'primari':170C 'publish':152C 'requir':149C 'result':165C 'sanit':120C 'script':103C,135C 'shortcod':166C 'site':102C,159C 'store':99C 'target':158C 'taxonomi':91C 'unauthent':129C 'user':143C 'var':106C 'version':110C 'via':104C 'vulner':97C 'web':134C 'whenev':141C 'wordpress':95C","first_public_at":"2026-11-06T10:16:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110776","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110776","severity":null,"published_at":"2026-11-06T10:16:35+00:00","modified_at":"2026-11-06T10:16:36+00:00","first_seen_at":"2026-11-06T10:40:56+00:00","fetched_at":"2026-11-06T10:40:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110776:1883","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-meta-data-filter-and-taxonomy-filter/mdtf-141-unauthenticated-stored-cross-site-scripting-via-vars-parameter","severity":null,"published_at":"2026-11-06T10:42:29+00:00","modified_at":"2026-11-06T10:42:29+00:00","first_seen_at":"2026-11-06T10:42:29+00:00","fetched_at":"2026-11-06T10:42:29+00:00","note":"Fixed in 1.4.2: Wordfence advisory (CNA, researcher Wordfence PRISM) lists patched 1.4.2; plugin author's wordpress.org changelog lists 1.4.2 'Security fix, thanks to Wordfence Prism System'. Only fix verified; affected range and shortcode condition come from Wordfence, not the vendor. No exploitation or PoC found; did not search social posts.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-meta-data-filter-and-taxonomy-filter/mdtf-141-unauthenticated-stored-cross-site-scripting-via-vars-parameter","https://wordpress.org/plugins/wp-meta-data-filter-and-taxonomy-filter/"]}],"documents":[{"id":85672,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-meta-data-filter-and-taxonomy-filter/mdtf-141-unauthenticated-stored-cross-site-scripting-via-vars-parameter","title":"Wordfence: MDTF <= 1.4.1 Unauthenticated Stored XSS via 'vars'","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":85673,"url":"https://wordpress.org/plugins/wp-meta-data-filter-and-taxonomy-filter/","title":"MDTF plugin page and changelog (wordpress.org)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}