The Multi‑column Tag Map plugin contains a stored cross‑site scripting flaw that is triggered by the admin‑visible setting ‘mctm_css_conditional’. Because the input is neither sanitized nor escaped on output, an attacker who can log into the WordPress administration interface with Administrator‑level rights can embed arbitrary JavaScript. When any user later visits a page that renders the affected option, the injected script runs in the victim’s browser, enabling activities such as phishing, cookie theft, or the insertion of additional malicious payloads. The vulnerability is limited to stored scripts; it is not an immediate remote code execution but still allows trusted users to launch client‑side attacks inside the site’s context.

WordPress sites that have the Multi‑column Tag Map plugin (tugbucket) installed in versions up to and including 17.0.39. The flaw is present only on multisite deployments and on installations where the WordPress configuration disables the unfiltered_html capability, meaning that standard administrators are the primary risk group.

The CVSS score of 4.4 reflects a moderate impact, while the EPSS score of less than 1% indicates a low likelihood that this flaw will see widespread exploitation in the near term. Because the flaw is listed as not part of the CISA KEV catalog, it has not yet been confirmed in live attacks, though an authenticated attacker can exploit it once they gain administrator access. The attack vector is post‑authentication; thus, compromising the account of a privileged user is required, but once the script is stored it propagates to all other users visiting affected pages.