CVE Database /
CVE-2025-13922
CVE · Medium
CVE-2025-13922 — Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms [simple-tags] < 3.41.0
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2025-13922
|
Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms [simple-tags] < 3.41.0 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
Medium
6.5
|
< 3.41.0
|
3.41.0 |
2025-12-05 |
—
|
CVE-2025-13922
The Tag, Category, and Taxonomy Manager plugin's interaction with OpenAI has a critical flaw in its handling of user-supplied input for the 'existing_terms_orderby' parameter within the AI preview endpoint. This weakness can be exploited by authenticated users with Contributor-level access or higher who also have AI metabox permissions to inject malicious SQL queries into existing database queries, potentially allowing them to extract sensitive data or disrupt system performance.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings