{"data":{"id":"754b9ccc-5a0f-46d0-bc00-4f7f5e8e041e","title":"CVE-2025-13359: The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based…","summary":"The Tag, Category, and Taxonomy Manager AI Autotagger with OpenAI plugin for WordPress contains a time-based SQL Injection flaw, tracked as CVE-2025-13359, in the \"getTermsForAjax\" function in all versions up to and including 3.40.1. Insufficient escaping of user-supplied parameters and a lack of prepared statements let authenticated attackers with contributor-level access and above append SQL queries to existing ones. Attackers who have metabox access for the taxonomy, enabled by default for contributors, can use this to extract sensitive database information.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-13359","publishedAt":"2025-12-03T19:15:47.890Z","cveId":"CVE-2025-13359","cweIds":["CWE-89"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Tag, Category, and Taxonomy Manager AI Autotagger SQL injection","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00368,"epssCheckedAt":"2026-11-04T12:08:33.192Z","kevDateAdded":null,"advisoryAliases":["GHSA-q5c3-w3j7-4hxr"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T06:10:27.624Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-66"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[]}}