WordPress plugin
WP Meta SEO security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High6
- Medium12
- Low0
All WP Meta SEO vulnerabilities
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter
≤4.5.18No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Logging
≤4.5.18No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.5.13Update to 4.5.14
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤4.5.13Update to 4.5.14
- Medium5.3Information Exposure via Meta Description
≤4.5.12Update to 4.5.13
- High7.2Unauthenticated Stored Cross-Site Scripting via Referer header
≤4.5.12Update to 4.5.13
- High8.8Authenticated (Author+) PHAR Deserialization
≤4.5.4Update to 4.5.5
- Medium5.4Missing Authorization in 'wpmsGGSaveInformation'
≤4.5.3Update to 4.5.4
- Medium4.3Cross-Site Request Forgery via 'regenerateSitemaps'
≤4.5.3Update to 4.5.4
- Medium4.3Missing Authorization in 'listPostsCategory'
≤4.5.3Update to 4.5.4
- Medium4.3Missing Authorization in 'checkAllCategoryInSitemap'
≤4.5.3Update to 4.5.4
- Medium5.4Missing Authorization in 'saveSitemapSettings'
≤4.5.3Update to 4.5.4
- Medium4.3Missing Authorization in 'regenerateSitemaps'
≤4.5.3Update to 4.5.4
- Medium4.3Cross-Site Request Forgery via 'setIgnore'
≤4.5.3Update to 4.5.4
- High7.1Missing Authorization in 'startProcess' to Arbitrary Redirect via 'update_link_redirect' task
≤4.5.2Update to 4.5.3
- High8.8Authenticated (Subscriber+) SQL Injection
≤4.5.2Update to 4.5.3
- High8.8Cross-Site Request Forgery to Settings Update
≤4.4.8Update to 4.4.9
- Medium5.5Admin+ Stored Cross-Site Scripting via breadcrumbs
≤4.4.6Update to 4.4.7
WP Meta SEO: common questions
Does WP Meta SEO have known vulnerabilities?
Yes. VulnCrest Radar lists 18 known vulnerabilities in WP Meta SEO: 6 high, 12 medium. At least one is not fixed in the latest version.
How do I check which version of WP Meta SEO I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WP Meta SEO vulnerability?
CVE-2026-11370, published Jun 23, 2026: WP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter. Severity: Medium (CVSS 6.4).
Is any WP Meta SEO vulnerability listed in CISA KEV?
No. None of the known WP Meta SEO vulnerabilities is currently listed in the CISA KEV catalog.