Now officially on WordPress.org

CVE Database / CVE-2025-13359

CVE · Medium

CVE-2025-13359 — Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms [simple-tags] < 3.41.0

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2025-13359 Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms [simple-tags] < 3.41.0 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Medium 6.5 < 3.41.0 3.41.0 2025-12-03 —

CVE-2025-13359

The Tag, Category, and Taxonomy Manager plugin for WordPress contains a vulnerability in its "getTermsForAjax" function, allowing authenticated attackers with contributor-level access or higher to inject malicious SQL code into database queries. This occurs due to inadequate protection against user-supplied input, enabling attackers to extract sensitive information from the database.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings