MathJax-LaTeX

MathJax-LaTeX has one disclosed vulnerability in the WordSec catalog, all reported in 2013; it is fixed as of September 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).

The one issue recorded for MathJax-LaTeX has a vendor fix available, so running the current release closes it.

All of these findings were reported by Junaid Hussain. MathJax-LaTeX is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.

Strategic Overview

Avg CVSSHigh
8.8/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all MathJax-LaTeX vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8

MathJax-LaTeX < 1.2 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

1 records
Showing 1–1 of 1 reports
Plugin Profile
Latestv1.3.13

MathJax-LaTeX

knowledgeblog

Author

knowledgeblog

4.4(11)
88/100
Last Updated
2025-01-14 (2y ago)
Active Installs
10,000+
Downloads
181,437
Requires WP
3.0+
Requires PHP
7.0.0+
Tested up to
WP 6.7.7
Created
2010-10-20 (16y ago)

MathJax enables enables rendering of embedded LaTeX or MathML in HTML pages. This plugin adds this functionality to WordPress. The MathJax JavaScript is inject on-demand only to those pages which require it. This ensures that MathJax is not loaded for all pages, which will otherwise slow loading down. The MathJax JavaScript can be delivered from your own server, or you can use the Cloudflare Content Distribution Network (CDN), which is the preferred mechanism as it offers increased speed and stability over hosting the JavaScript and configuring the library yourself. You may embed latex using a variety of different syntaxes. The shortcode (https://codex.wordpress.org/Shortcode_API) syntax is preferred. So [latex]E=mc^2[/latex] will work out of the box. This also forces loading of MathJax. Additionally, you can use native MathJax syntax — $$E=mc^2$$ or \(E=mc^2\). However, if this is the only syntax used, the plugin must be explicitly told to load MathJax for the current page. This can be achieved by adding a [mathjax] shortcode anywhere in the post. For posts with both [latex]x[/latex] and $$x$$ syntaxes this is unnecessary. You can use wp-latex syntax, $latex E=mc^2$. Parameters can be specified as with wp-latex but will be ignored. This means that MathJax-LaTeX should be a drop-in replacement for wp-latex. Because this conflicts with wp-latex, this behaviour is blocked when wp-latex is present, and must be explicitly enabled in the settings. You can also specify [nomathjax] — this will block mathjax on the current page, regardless of other tags. MathJax-LaTeX is developed on GitHub. Copyright This plugin is copyright Phillip Lord, Newcastle University and is licensed under GPLv2.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C