TagGator
TagGator has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2012 and 2024; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 8.0, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.
The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include SQL Injection.
1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2024.
2 independent researchers contributed these findings, one record each. TagGator is installed on roughly 50 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2024-54390TagGator <= 1.54 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records

TagGator
Author
Bouzid Nazim Zitouni
TagGator lets you build a keyword list and apply matching tags to all your posts in one click. How it works: Enter your tag words in the Tag List — one per line, or comma-separated. Each word is both the tag name and the keyword searched for. Configure matching options (case-sensitive, whole words, minimum occurrences). Click Preview to see what would be tagged, or Bulk Tag All Posts to apply tags immediately. Use Remove Unmatched Tags to clean up stale tags if you update your list. Example tag list: JavaScript, PHP, Python WordPress, Gutenberg Node.js, React, Vue A post containing “JavaScript” receives the “JavaScript” tag. Tags are only applied when the minimum match count is met, so you stay in control. Features: Flat tag list — every word is both tag and keyword, no complex syntax Case-sensitive or case-insensitive matching Whole-word or substring matching Minimum match count in body and/or title Enable/disable tagging per post type Choose which taxonomy to tag with per post type Preview before committing — no surprises Remove Unmatched Tags cleans up only plugin-applied tags, never manually added ones Tagging history in the post editor sidebar No external dependencies, no tracking, no telemetry Looking for more? [TagGator Pro] adds: Auto-tag posts on save — no manual bulk runs needed Keyword-to-tag synonym mapping (one tag, many keywords per line) Exclude posts by ID, category, or author Per-post and per-user exclusion controls Priority support
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C