Taskbuilder for WordPress is vulnerable to an authorization bypass that allows any authenticated user with at least subscriber privileges to add comments to any project or task, including those private or not assigned to them. The comment body is insufficiently sanitized, enabling injection of arbitrary HTML and CSS. This flaw can be abused to compromise the integrity and appearance of the project management interface for users who view the injected content.

All installations of Taskbuilder up through version 5.0.2 are affected. The vulnerability exists in the AJAX handlers that process project and task comment submissions, and it requires the installation of the plugin on a WordPress site.

The CVSS score of 4.3 indicates moderate risk, while the EPSS score of less than 1% suggests a low likelihood of current exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the attack vector is a web-based interaction with the plugin’s AJAX endpoints that an authenticated user can reach through the site’s normal interface. The attacker only needs subscriber-level access and can therefore exploit the flaw without prior elevated privileges.