CVE-2023-28664

Name of the Vulnerable Software and Affected Versions Meta Data and Taxonomies Filter WordPress plugin versions prior to 1.3.1

Description The issue is a reflected cross-site scripting vulnerability in the tax name parameter of the mdf get tax options in widget action. This can only be triggered by an authenticated user.

Recommendations For versions prior to 1.3.1, update to version 1.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the mdf get tax options in widget action to minimize the risk of exploitation. Avoid using the tax name parameter in the affected action until the issue is resolved.