Summary

The “Related Posts by Taxonomy” plugin contains a reflected XSS vulnerability that can allow an attacker to inject arbitrary script into pages where untrusted input is rendered without proper sanitisation. Exploitation requires the attacker to persuade a user to visit a crafted URL or submit specially formed data that the plugin echoes back into the page context.

Technical Details

Root cause: insufficient output encoding on user-controllable parameters when rendering related-posts listings or taxonomy-based queries. Attack vectors include GET parameters and potentially POSTed values that influence displayed labels or links.

Impact: successful XSS can lead to session theft, actions performed as the victim, or content manipulation in the victim’s browser. Given the common trust model of WordPress admin and author interfaces, even limited XSS can be leveraged for further attacks in multi-user sites.

Detection

Indicators of a vulnerable instance:

• Plugin installed and active in plugin list with versions prior to the fix (check plugin changelog for exact fixed version).
• Pages that display taxonomy-related widgets or related-posts blocks echo URL/query parameters in the HTML output without escaping.

Testing (for authorised personnel only): append a benign test payload such as <script></script> in a parameter and observe whether it executes or appears raw in the page source. Do not test on production systems without permission.

Mitigation

Until an official vendor patch is applied, administrators should:

• Temporarily disable the plugin if it is not essential to site operation.
• Restrict access to pages that render taxonomy-driven content to trusted users only (where feasible).
• Sanitise or validate user input at web application firewall or reverse-proxy level where you control request filtering (organisation-managed controls).

Apply the official patch from the plugin maintainer as soon as it is available and verify the update addresses the unsanitised outputs described above.

Recommended Post‑Compromise Actions

• Audit user accounts and activity logs for suspicious actions or new administrative users.
• Rotate credentials for any accounts that may have been exposed, including API keys and integration tokens.
• Review site integrity — compare core/plugin/theme files with known-good copies and check for unauthorised modifications.

Attribution & References

Primary reference: CVE record for CVE-2026-0916. Consult official plugin changelog and vendor advisory for patch details and fixed versions.

Need this converted into your full post?

If you would like me to convert your original blog text into this Hong Kong Security Expert tone and produce a ready-to-publish HTML version (with the vulnerability summary table included and any vendor mentions removed), paste the blog content below. I will return a complete HTML article tailored for WordPress publishing and ensure all disallowed vendor recommendations are omitted.