Meta Box <= 5.15.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider, Range and File Input Field Values
- ID
- WPSEC-2026-2696
- Plugin
- Meta Box – A Framework for Dynamic Websites (meta-box)
- Affected
- all versions before 5.15.4
- Remediation
- Update to 5.15.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-07
- Attack surface
- Meta Box on WPSec AttackSurface
- Fix released
- Published
Description
The Meta Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider, range and file input field values in all versions up to, and including, 5.15.3, due to insufficient output escaping of the stored meta value when these fields are rendered in the edit screen. Values saved through the meta box form are sanitized, but values written directly as post meta (for example through the core Custom Fields panel) are printed raw. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute whenever a user, such as an editor or administrator, opens the post's edit screen.
References
- https://wpsec.com/vuln/WPSEC-2026-2696/
- https://plugins.svn.wordpress.org/meta-box/tags/5.15.4/
- https://wordpress.org/plugins/meta-box/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS