---
id: "CVE-2026-110776"
page: "https://infrastack.ai/live/CVE-2026-110776"
kind: "vulnerability"
aliases: ["CVE-2026-110776"]
title: "MDTF WordPress plugin: unauthenticated stored XSS through the vars parameter"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "wp-meta-data-filter-and-taxonomy-filter", "fixed": ["1.4.2"], "affected": "<= 1.4.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["mdtf", "package", "unauthenticated", "web-frontend", "wordpress", "wordpress-plugin", "xss"]
not_affected_if: ["plugin-1.4.2-or-newer", "plugin-newer-than-1.4.1", "plugin-not-installed", "shortcode-not-used"]
published_at: "2026-11-06T10:16:35+00:00"
first_seen_at: "2026-11-06T10:40:56+00:00"
updated_at: "2026-11-06T10:42:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110776", "first_seen_at": "2026-11-06T10:40:56+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-meta-data-filter-and-taxonomy-filter/mdtf-141-unauthenticated-stored-cross-site-scripting-via-vars-parameter", "first_seen_at": "2026-11-06T10:42:29+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-meta-data-filter-and-taxonomy-filter/mdtf-141-unauthenticated-stored-cross-site-scripting-via-vars-parameter", "https://wordpress.org/plugins/wp-meta-data-filter-and-taxonomy-filter/"]}]
exploit_sources: []
---

# MDTF WordPress plugin: unauthenticated stored XSS through the vars parameter

Link for people: https://infrastack.ai/live/CVE-2026-110776 (this .md is for agents)

The MDTF Meta Data and Taxonomies Filter plugin for WordPress does not sanitize the 'vars' parameter, so attackers can store scripts that run in visitors' browsers. An unauthenticated attacker can inject script into a page that displays the plugin's shortcode, and it runs whenever a user opens that page.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:wp-meta-data-filter-and-taxonomy-filter affected <= 1.4.1 fixed 1.4.2

## How to check

- Check whether the plugin is installed and its version is `1.4.1` or older in the WordPress admin under Plugins.
- Search published posts and pages for the shortcode `[meta_data_filter_results]`.

## Fix

Update the MDTF plugin (wp-meta-data-filter-and-taxonomy-filter) to 1.4.2 or newer.

## Timeline

- 2026-11-06T10:40:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110776
- 2026-11-06T10:42:29+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-meta-data-filter-and-taxonomy-filter/mdtf-141-unauthenticated-stored-cross-site-scripting-via-vars-parameter — Fixed in 1.4.2: Wordfence advisory (CNA, researcher Wordfence PRISM) lists patched 1.4.2; plugin author's wordpress.org changelog lists 1.4.2 'Security fix, thanks to Wordfence Prism System'. Only fix verified; affected range and shortcode condition come from Wordfence, not the vendor. No exploitation or PoC found; did not search social posts.

## Documents

- [advisory] Wordfence: MDTF <= 1.4.1 Unauthenticated Stored XSS via 'vars' https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-meta-data-filter-and-taxonomy-filter/mdtf-141-unauthenticated-stored-cross-site-scripting-via-vars-parameter
- [fix] MDTF plugin page and changelog (wordpress.org) https://wordpress.org/plugins/wp-meta-data-filter-and-taxonomy-filter/

## From the sources

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vars' parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that a published page or post on the target site contains the [meta_data_filter_results] shortcode, which is the primary output feature of the plugin.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_