The vulnerability is a stored cross‑site scripting flaw that originates from the plugin’s failure to neutralize user‑supplied content when it is saved and later rendered in taxonomies. An attacker can inject malicious JavaScript that will execute in the browsers of any visitor who loads a taxonomy page populated by the compromised entry.

This issue affects the WordPress Multi‑Column Taxonomy List plugin, version 1.5 and earlier, released by Matthew Muro. Sites that run any affected version and allow the creation or editing of taxonomy terms via the plugin are in scope.

The CVSS score of 6.5 indicates moderate severity. With an EPSS score below 1 % and no listing in the CISA KEV catalog, the probability of exploitation today is low, yet the stored XSS payload can lead to defacement, cookie theft or redirection for all page visitors. An attacker can exploit the flaw by inserting malicious content into a taxonomy entry that the plugin then serves without encoding, so the attack requires the ability to edit or create taxonomy terms – typically an administrator or a user with term‑management privileges.