Same but Different – Related Posts by Taxonomy WordPress Plugin Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the Same but Different – Related Posts by Taxonomy plugin for WordPress, affecting all versions through 1.0.16. The vulnerability arises from the plugin's use of add_query_arg and remove_query_arg functions without proper escaping, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts could be executed if a user is tricked into clicking a link that contains the injected script.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject scripts that are executed in the context of the user's browser.