Meta Box <= 5.15.2 — Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Meta Box – A Framework for Dynamic Websites.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 5.15.3, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Meta Box – A Framework for Dynamic Websites to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Md. Moniruzzaman Prodhan (NomanProdhan).

The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profile_background[<attacker-chosen key>]' parameter in all versions up to, and including, 5.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitability depends on a consuming plugin or theme built on Meta Box that exposes the background field to lower-privileged users and renders stored values via the rwmb_the_value()/format_single_value() pattern; the effective minimum privilege is whatever role that consumer permits, demonstrated at Subscriber level.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Oct 28, 2026

   CVE published

   Severity medium, CVSS 4.9

2. Nov 13, 2026

   Record last updated