CVE-2023-52225 is a critical severity (10.0) PHP object injection in the Taggbox (UGC Galleries, Social Media Widgets, User Reviews and Analytics) WordPress plugin, affecting version 3.1 and earlier. The developer fixed it in version 3.2. Update the plugin to 3.2 or later, and if you cannot update, deactivate it until you can.
What's affected
The NVD record names Taggbox and the Taggbox (UGC Galleries, Social Media Widgets, User Reviews and Analytics) plugin for WordPress, from the earliest release through 3.1. Patchstack lists 3.2 as the patched version. Upgrade to 3.2 or any later release.
The weakness is CWE-502, deserialization of untrusted data. The record's CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which gives 10.0 (Critical).
Patchstack lists the required privilege as unauthenticated. No login is needed, and the score is the maximum 10.0. Patchstack rates it high priority and says a mitigation rule exists for its customers, which does not replace updating.
How to check if you're exposed
Start with the plugin list. On a server with WP-CLI, run this from the site folder:
wp plugin list
wp plugin get taggbox-widget
The first command shows every installed plugin with its version and status. The second shows the details of this one. If the slug is not found, the plugin is not installed under that folder name.
Without shell access, open Plugins, Installed Plugins in the admin and read the version under the plugin name. On WordPress multisite, check the network plugin list and each site, since a plugin can be active on only some of them.
A version at or below 3.1 is in the affected range. An inactive plugin is lower risk than an active one, but it is still on disk, so remove it if it is unused.
What to do now
- Open the Plugins screen, or run the WP-CLI check above, and note the installed version.
- Update Taggbox (UGC Galleries, Social Media Widgets, User Reviews and Analytics) to 3.2 or later on staging first if you test changes, then on production.
- If the update cannot go out today, deactivate the plugin. A deactivated plugin does not run its code.
- Review recent activity: check web server logs for unusual requests and look for unfamiliar files or new administrator accounts.
- Add the plugin to whatever tracks your WordPress inventory, so the next advisory finds it quickly.
Why it matters
Deserialization of untrusted data means the plugin rebuilds a PHP object from a string supplied by the requester. In PHP, rebuilding an object can trigger code in the application or in other installed libraries. Patchstack calls this PHP object injection and describes the result as attackers being able to make the site run harmful actions on the server.
The danger often depends on which other classes are loaded on the site, so the real impact varies between installations. The score is high because the worst case is full control of the server side code, and because several of these plugins accept the data without a login. Social widget plugins run on public pages, so the entry point is exposed to every visitor. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and the sources I read do not report exploitation in the wild. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan and the Gold directory help you track which components you run and which advisories apply.
Quick check
What is the safest first step for CVE-2023-52225?
Update Taggbox to 3.2 or later. If that has to wait, deactivate the plugin, because the flaw needs no login.
Is there a patched version?
Yes. Patchstack lists 3.2 as the patched release for versions up to 3.1. Check the plugin's own changelog before you upgrade.
Sources
Last reviewed: 19 October 2026.
