Stored Cross-Site Scripting in Multi-column Tag Map Plugin for WordPress

CVE-2025-14057

What is CVE-2025-14057?

The Multi-column Tag Map plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability that arises from inadequate input sanitization and output escaping. Authenticated users with administrator-level permissions can exploit this vulnerability to inject malicious web scripts into the admin settings. The injected scripts are executed whenever any user accesses the compromised pages. This issue notably affects multi-site installations as well as those where the 'unfiltered_html' option is disabled, highlighting critical security considerations for site administrators.

References