Executive brief
The Taskbuilder plugin for WordPress, which is used to manage projects and tasks, contains a security flaw that allows attackers to execute malicious scripts in a user's browser. By tricking a logged-in user into clicking a specially crafted link, an attacker could potentially steal session information, perform actions on behalf of the user, or deface the website. This issue affects any site using the plugin's shortcodes on its public pages.
Technical details
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Taskbuilder WordPress plugin before version 5.0.8. The flaw is located in the handling of URL parameters (specifically 'project-id') which are echoed directly into inline JavaScript blocks on frontend pages containing plugin shortcodes like [wppm_projects]. An attacker can exploit this by crafting a malicious URL containing a JavaScript payload and tricking a logged-in user into visiting it. Successful exploitation allows for arbitrary script execution in the context of the victim's browser session, which can lead to session hijacking or unauthorized actions. The issue was addressed in version 5.0.8.
Affected products
- Unknown Taskbuilder < 5.0.8
Timeline
- 2026-05-27: disclosed: Publicly published via WPScan
- 2026-06-17: advisory: NVD advisory published
- 2026-05-27: patched: Fix available in version 5.0.8