Does current pause on WordPress Plugin Directory imply Security danger?

Nigel Parry
(@nigelparrydotnet)

5 months, 1 week ago

Currently the WordPress plugin directory says “This plugin has been closed as of January 5, 2026 and is not available for download. This closure is temporary, pending a full review.”

Does this imply any security risk? I have the plugin, which works fine for me, on several sites.

It’s an amazing plugin that should become a standard part of WordPress. A single page, a single shortcode, and you have a “back of book index page” that updates itself.

The page I need help with: [log in to see the link]

Viewing 5 replies - 1 through 5 (of 5 total)

Robert Poth
(@rpweb777)

5 months ago

I’m using this plugin as well. According to wordfence there is a security vulnerability but in my view with relatively low risk, see: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/multi-column-tag-map/multi-column-tag-map-17039-authenticated-administrator-stored-cross-site-scripting-via-mctm-css-conditional-parameter

An attacker would need to have administrator-level permissions and above.

Plugin Author tugbucket
(@tugbucket)

3 months, 3 weeks ago

I wrote WP plugin dept about the notice as I didn’t receive an email about it back in January. I’ll let y’all know what I find out and when I can, I’ll patch that minor security leak.

Thread Starter Nigel Parry
(@nigelparrydotnet)

3 months, 2 weeks ago

Thanks for the update. It’s not on WP’s plugin download directory for now.

Wordfence’s take is “possible for authenticated attackers, with administrator-level permissions and above to….[insert wreak havoc]”. If you’ve got admin access leaked out there or a rogue admin, MCTM is going to be the least of your problems. 😀

StimpsonJCat
(@stimpsonjcat)

4 weeks, 1 day ago

It has been 5 months since the security breach has been discovered. Still no update available?
Thread Starter Nigel Parry
(@nigelparrydotnet)

1 week, 3 days ago
Just looking for an update to this. It’s kind of a dumb flag. The “danger” is “possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.”*

I mean, if you have admin access, you can do anything sinister you want to the WordPress site you have admin access to.

I’m not sure why this plugin would be flagged and not WordPress as a whole because anyone with an admin or above privileges can do bad things with a site. Isn’t this just describing a WordPress problem?

*Source: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/multi-column-tag-map/multi-column-tag-map-17039-authenticated-administrator-stored-cross-site-scripting-via-mctm-css-conditional-parameter
- This reply was modified 1 week, 3 days ago by Nigel Parry.
- This reply was modified 1 week, 3 days ago by Nigel Parry. Reason: Clarity

Viewing 5 replies - 1 through 5 (of 5 total)

The topic ‘Does current pause on WordPress Plugin Directory imply Security danger?’ is closed to new replies.