Vulnerability alerts / November 7, 2026

Vulnerability in Meta Box — CVE-2026-123472

MediumSeverity
CVSS 6.5

—Estimated exploit probability
EPSS

500,000+ sitesInstalls

5.15.4Fixed in

What to do now

Update Meta Box to 5.15.4 or later.

Affected versions

Everything up to and including 5.15.3

Affected: Meta Box (plugin, meta-box)

Check: The plugin on wordpress.org / Our record for Meta Box

What the vulnerability is

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Stored XSS.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.3.

This description is reproduced verbatim from the public vulnerability record.

Sources

https://patchstack.com/database/wordpress/plugin/meta-box/vulnerability/wordpress-meta-box-wordpress-custom-fields-framework-plugin-5-15-3-cross-site-scripting-xss-vulnerability?_s_id=cve

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.

See other alerts