PluginUs.Net MDTF vulnerabilities

Latest PluginUs.Net MDTF CVEs

Newest publication first

1. CVE-2026-108175 WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-15

   Medium·CVSS 6.5

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Stored XSS.This issue affects MDTF: from n/a through 1.4.0.

2. CVE-2026-108151 WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vulnerability

   Published 2026-10-14

   Medium·CVSS 5.3

   Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This issue affects MDTF: from n/a through 1.3.9.

3. CVE-2026-54845 WordPress MDTF plugin <= 1.3.8 - Local File Inclusion vulnerability

   Published 2026-06-25

   High·CVSS 8.1

   Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.

4. CVE-2026-54843 WordPress MDTF plugin <= 1.3.7 - SQL Injection vulnerability

   Published 2026-06-25

   Critical·CVSS 9.3

   Unauthenticated SQL Injection in MDTF <= 1.3.7 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.