¿Es seguro Simple Tags?

Qué hace este plugin

• Slug: simple-tags
• 50000+ instalaciones activas

categoriescategorytagtag cloudtaxonomy

Estado de mantenimiento

• Última versión conocida: 3.50.0
• Requiere PHP: 7.4+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

12 CVEs conocidos registrados para Simple Tags.

CVE-2026-42646

The TaxoPress plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.44.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-14371

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the taxopress_ai_add_post_term function in all versions up to, and including, 3.41.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to add or remove taxonomy terms (tags, categories) on any post, including ones they do not own.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-13922

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'existing_terms_orderby' parameter in the AI preview AJAX endpoint in all versions up to, and including, 3.40.1. This is due to insufficient escaping on user-supplied parameters and lack of SQL query parameterization. This makes it possible for authenticated attackers, with Contributor-level access and above who have AI metabox permissions, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, cause performance degradation, or enable data inference through time-based techniques.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-13359

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based SQL Injection via the "getTermsForAjax" function in all versions up to, and including, 3.40.1. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database granted they have metabox access for the taxonomy (enabled by default for contributors).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-13354

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.40.1. This is due to the plugin not properly verifying that a user is authorized to perform an action in the "taxopress_merge_terms_batch" function. This makes it possible for authenticated attackers, with subscriber level access and above, to merge or delete arbitrary taxonomy terms.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-11972

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'post_types' parameter in all versions up to, and including, 3.40.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-55710

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.37.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-2830

Update the WordPress TaxoPress plugin to the latest available version (at least 3.20.0). stealthcopter discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress TaxoPress Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.20.0. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

+ 8 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2023-2168	Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms [simple-tags] < 3.6.5	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 4,8	< 3.6.5	3.6.5	2023-04-18	✓ corregido en la última versión
CVE-2023-2169	Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms [simple-tags] < 3.6.5	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 4,8	< 3.6.5	3.6.5	2023-04-18	✓ corregido en la última versión
CVE-2023-2170	Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms [simple-tags] < 3.6.5	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 4,8	< 3.6.5	3.6.5	2023-04-18	✓ corregido en la última versión
—	Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms [simple-tags] < 3.4.5	—	Desconocido	< 3.4.5	3.4.5	2023-02-07	✓ corregido en la última versión
—	Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms [simple-tags] < 3.4.5	—	Desconocido	< 3.4.5	3.4.5	2022-02-07	✓ corregido en la última versión
CVE-2021-24444	Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms [simple-tags] < 3.0.7.2	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 4,8	< 3.0.7.2	3.0.7.2	2021-06-30	✓ corregido en la última versión
—	Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms [simple-tags] < 3.30.0	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Baja 3,5	< 3.30.0	3.30.0	0000-00-00	✓ corregido en la última versión
—	Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms [simple-tags] < 3.4.5	—	Desconocido	< 3.4.5	3.4.5	—	✓ corregido en la última versión

CVE-2023-2168

Update the WordPress TaxoPress plugin to the latest available version (at least 3.6.5). Ivan Kuzymchak discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress TaxoPress Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.6.5.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-2169

Update the WordPress TaxoPress plugin to the latest available version (at least 3.6.5). Ivan Kuzymchak discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress TaxoPress Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.6.5.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-2170

Update the WordPress TaxoPress plugin to the latest available version (at least 3.6.5). Ivan Kuzymchak discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress TaxoPress Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.6.5.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms [simple-tags] < 3.4.5

Update the WordPress TaxoPress plugin to the latest available version (at least 3.4.5). WPScanTeam discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress TaxoPress Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.4.5.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms [simple-tags] < 3.4.5

The TaxoPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.4.4 due to missing input and output sanitization of some user generated URLs.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2021-24444

The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms [simple-tags] < 3.30.0

The WordPress Tag, Category, and Taxonomy Manager – AI Autotagger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.32.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms [simple-tags] < 3.4.5

The plugin does not escape some generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Simple Tags actualizado — 3.50.0 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• List category posts — 80000+ instalaciones activas — 94/100 (254) — PHP máx. 8.4
• Media Library Assistant — 70000+ instalaciones activas — 96/100 (201) — PHP máx. 8.4
• Pages with category and tag — 60000+ instalaciones activas — 96/100 (27) — PHP máx. 8.4
• Search & Filter — 50000+ instalaciones activas — 90/100 (175) — PHP máx. 8.4
• Category Posts Widget — 40000+ instalaciones activas — 90/100 (79) — PHP máx. 8.4