Stored Cross-Site Scripting in MDTF Plugin for WordPress

CVE-2026-110776

What is CVE-2026-110776?

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'vars' parameter, attributed to inadequate input sanitization and output escaping. This vulnerability enables unauthenticated adversaries to inject malicious web scripts into pages that execute whenever a user visits an affected page. The exploit necessitates the presence of the [meta_data_filter_results] shortcode within a published page or post on the targeted site, highlighting the importance of proper code validation and sanitization in preventing such attacks. Site administrators should consider immediate steps to secure their installations by reviewing plugin usage and updating to the latest patched version.

References