CVE-2025-6719

Name of the Vulnerable Software and Affected Versions Terms descriptions plugin for WordPress versions prior to 3.4.9

Description The Terms descriptions plugin for WordPress is susceptible to Stored Cross-Site Scripting through admin settings. Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts into pages. These scripts execute when a user accesses the injected page. This issue only affects multi-site installations and installations where unfiltered html has been disabled.

Recommendations Update the Terms descriptions plugin to version 3.4.9 or later.