{
 "id": "WPSEC-2026-2696",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2696/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2696/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2696/index.md",
 "title": "Meta Box <= 5.15.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider, Range and File Input Field Values",
 "description": "The Meta Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider, range and file input field values in all versions up to, and including, 5.15.3, due to insufficient output escaping of the stored meta value when these fields are rendered in the edit screen. Values saved through the meta box form are sanitized, but values written directly as post meta (for example through the core Custom Fields panel) are printed raw. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute whenever a user, such as an editor or administrator, opens the post's edit screen.",
 "plugin": {
  "slug": "meta-box",
  "name": "Meta Box",
  "full_name": "Meta Box – A Framework for Dynamic Websites",
  "wordpress_org": "https://wordpress.org/plugins/meta-box/",
  "advisories_url": "https://wpsec.com/vuln/plugin/meta-box/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/meta-box"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.15.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.15.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.15.4",
 "remediation": "Update to 5.15.4 or later.",
 "fix_released": "2026-11-06T09:11:10+00:00",
 "published": "2026-11-07T09:40:48+00:00",
 "updated": "2026-11-06T12:04:32.440174+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2696/",
  "https://plugins.svn.wordpress.org/meta-box/tags/5.15.4/",
  "https://wordpress.org/plugins/meta-box/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/meta-box",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-07"
 }
}