Does current pause on WordPress Plugin Directory imply Security danger? | ww.wp.xz.cn

Nigel Parry
(@nigelparrydotnet)

4 months, 2 weeks ago

Currently the WordPress plugin directory says “This plugin has been closed as of January 5, 2026 and is not available for download. This closure is temporary, pending a full review.”

Does this imply any security risk? I have the plugin, which works fine for me, on several sites.

It’s an amazing plugin that should become a standard part of WordPress. A single page, a single shortcode, and you have a “back of book index page” that updates itself.

The page I need help with: [log in to see the link]

Viewing 4 replies - 1 through 4 (of 4 total)

Robert Poth
(@rpweb777)

4 months, 2 weeks ago

I’m using this plugin as well. According to wordfence there is a security vulnerability but in my view with relatively low risk, see: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/multi-column-tag-map/multi-column-tag-map-17039-authenticated-administrator-stored-cross-site-scripting-via-mctm-css-conditional-parameter

An attacker would need to have administrator-level permissions and above.

Plugin Author tugbucket
(@tugbucket)

3 months ago

I wrote WP plugin dept about the notice as I didn’t receive an email about it back in January. I’ll let y’all know what I find out and when I can, I’ll patch that minor security leak.

Thread Starter Nigel Parry
(@nigelparrydotnet)

2 months, 3 weeks ago

Thanks for the update. It’s not on WP’s plugin download directory for now.

Wordfence’s take is “possible for authenticated attackers, with administrator-level permissions and above to….[insert wreak havoc]”. If you’ve got admin access leaked out there or a rogue admin, MCTM is going to be the least of your problems. 😀

StimpsonJCat
(@stimpsonjcat)

1 week, 1 day ago

It has been 5 months since the security breach has been discovered. Still no update available?

Viewing 4 replies - 1 through 4 (of 4 total)

You must be logged in to reply to this topic.

5 replies
4 participants
Last reply from: StimpsonJCat
Last activity: 1 week, 1 day ago
Status: not resolved