WordPress Tag and Category Manager Vulnerability – AI Autotagger – Authenticated Stored Cross-Site Scripting via Shortcode – CVE-2024-2830 | WordPress Plugin Vulnerability Report

Plugin Name: WordPress Tag and Category Manager – AI Autotagger

Key Information:

  • Software Type: Plugin
  • Software Slug: simple-tags
  • Software Status: Active
  • Software Author: stevejburge
  • Software Downloads: 4,604,554
  • Active Installs: 60,000
  • Last Updated: April 3, 2024
  • Patched Versions: 3.20.0
  • Affected Versions: <= 3.13.0

Vulnerability Details:

  • Name: WordPress Tag and Category Manager – AI Autotagger <= 3.13.0
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-2830
  • CVSS Score: 6.4
  • Publicly Published: April 3, 2024
  • Researcher: stealthcopter
  • Description: The plugin is susceptible to Stored Cross-Site Scripting (XSS) through its 'st_tag_cloud' shortcode, arising from inadequate input sanitization and output escaping. Authenticated attackers with contributor-level access can exploit this to execute arbitrary web scripts whenever a user accesses a compromised page.


The WordPress Tag and Category Manager – AI Autotagger plugin, a tool enhancing tag and category management in WordPress, faces a security issue in versions up to 3.13.0. Identified as CVE-2024-2830, this vulnerability allows for Stored Cross-Site Scripting attacks, highlighting the importance of strict input handling within plugins. The issue has been resolved in version 3.20.0, emphasizing the critical nature of timely software updates.

Detailed Overview:

Discovered by researcher stealthcopter, CVE-2024-2830 underscores the importance of stringent input sanitization in WordPress plugins. The potential for attackers to inject and execute harmful scripts poses significant risks to site integrity and user data. The release of version 3.20.0 rectifies this vulnerability, ensuring enhanced security for users of the WordPress Tag and Category Manager.

Advice for Users:

  • Immediate Action: Update the plugin to version 3.20.0 to safeguard against CVE-2024-2830.
  • Check for Signs of Vulnerability: Monitor site activity for indications of unauthorized script injections or other signs of compromise.
  • Alternate Plugins: While the vulnerability has been addressed, users may consider other tag management plugins with a proven security track record as an added precaution.
  • Stay Updated: Regular updates are essential for maintaining the security and functionality of WordPress sites.


The swift action taken to address CVE-2024-2830 in the WordPress Tag and Category Manager – AI Autotagger plugin highlights the ongoing need for vigilance in the digital landscape. For WordPress site owners, particularly small businesses, staying abreast of plugin updates is crucial for ensuring site security. In an ever-evolving threat environment, proactive measures and informed decisions are key to protecting online assets.


Detailed Report: 


In the digital realm where WordPress powers a significant portion of the web, plugin vulnerabilities present a serious challenge to website security. The WordPress Tag and Category Manager – AI Autotagger, a plugin esteemed for its capability to refine tag and category management within WordPress, has been recently identified with a vulnerability that could compromise site security and user data. This vulnerability, known as CVE-2024-2830, has brought to the forefront the critical need for timely updates and stringent security measures.

Vulnerability Details:

The vulnerability, CVE-2024-2830, manifests through the plugin's 'st_tag_cloud' shortcode and stems from insufficient input sanitization and output escaping. It allows authenticated users with contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an affected page, leading to potential Stored Cross-Site Scripting (XSS) attacks.

Risks and Impacts:

The ability for attackers to execute arbitrary scripts poses a significant risk to the integrity of WordPress sites using the affected plugin versions. This vulnerability could lead to unauthorized data access, manipulation of site content, and compromise of user data.


The developers have addressed this vulnerability in version 3.20.0 of the plugin. Users are urged to update their plugin to this latest version immediately to mitigate the associated risks.

Previous Vulnerabilities:

This isn't the first time vulnerabilities have been discovered in the WordPress Tag and Category Manager – AI Autotagger, with 5 previous vulnerabilities reported since June 30, 2021. This history underlines the importance of regular monitoring and updating.


The prompt resolution of CVE-2024-2830 by the plugin's development team underscores the critical role of vigilant software management in safeguarding digital assets. For WordPress site owners, especially those managing small businesses, the episode serves as a potent reminder of the need to remain proactive in maintaining plugin updates. In an online environment rife with evolving threats, a commitment to security practices, informed by the latest developments and expert insights, is indispensable for protecting your site and maintaining the trust of your visitors.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

WordPress Tag and Category Manager Vulnerability – AI Autotagger – Authenticated Stored Cross-Site Scripting via Shortcode – CVE-2024-2830 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment