# Meta Box <= 5.15.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider, Range and File Input Field Values

- **ID:** WPSEC-2026-2696
- **Plugin:** Meta Box – A Framework for Dynamic Websites (`meta-box`), https://wordpress.org/plugins/meta-box/
- **Affected versions:** all versions before 5.15.4
- **Fixed in:** 5.15.4 (Update to 5.15.4 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/meta-box
- **Fix released:** 2026-11-06
- **Published:** 2026-11-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2696/

## Description

The Meta Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider, range and file input field values in all versions up to, and including, 5.15.3, due to insufficient output escaping of the stored meta value when these fields are rendered in the edit screen. Values saved through the meta box form are sanitized, but values written directly as post meta (for example through the core Custom Fields panel) are printed raw. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute whenever a user, such as an editor or administrator, opens the post's edit screen.

## References

- https://wpsec.com/vuln/WPSEC-2026-2696/
- https://plugins.svn.wordpress.org/meta-box/tags/5.15.4/
- https://wordpress.org/plugins/meta-box/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2696/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.