{"id":"CVE-2026-109216","kind":"vulnerability","aliases":["CVE-2026-109216"],"related":[],"title":"Meta Box WordPress plugin: stored XSS via profile background parameter","description":"The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profile_background[<attacker-chosen key>]' parameter in all versions up to, and including, 5.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitability depends on a consuming plugin or theme built on Meta Box that exposes the background field to lower-privileged users and renders stored values via the rwmb_the_value()/format_single_value() pattern; the effective minimum privilege is whatever role that consumer permits, demonstrated at Subscriber level.","summary":"The Meta Box WordPress plugin up to and including 5.15.2 does not sanitize or escape the 'profile_background' parameter, so stored values can contain scripts. An authenticated user with subscriber-level access can inject JavaScript that runs in the browser of anyone who views the affected page.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["meta-box","package","self-hosted","wordpress"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check whether the site runs the Meta Box plugin and note its version in the WordPress plugins list or `wp plugin get meta-box --field=version`\n- Look for a consuming plugin or theme that exposes the background field to subscribers and renders it with `rwmb_the_value()` or `format_single_value()`","fix":"- Move the Meta Box plugin to a version later than `5.15.2` (the sources do not name the exact fixed release)","status":"open","published_at":"2026-10-29T12:17:09+00:00","first_seen_at":"2026-10-29T12:24:38+00:00","triaged_at":"2026-10-29T12:25:40+00:00","updated_at":"2026-10-29T12:25:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T12:25:40Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Meta Box plugin to a version later than `5.15.2` (the sources do not name the exact fixed release)","reach":"internet","title":"Meta Box WordPress plugin: stored XSS via profile background parameter","impact":"medium","summary":"The Meta Box WordPress plugin up to and including 5.15.2 does not sanitize or escape the 'profile_background' parameter, so stored values can contain scripts. An authenticated user with subscriber-level access can inject JavaScript that runs in the browser of anyone who views the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","meta-box","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Injected scripts run in visitors' browsers and can steal sessions.","analyst_note":"","how_to_check":"- Check whether the site runs the Meta Box plugin and note its version in the WordPress plugins list or `wp plugin get meta-box --field=version`\n- Look for a consuming plugin or theme that exposes the background field to subscribers and renders it with `rwmb_the_value()` or `format_single_value()`","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","auth-required"],"who_is_affected":"Sites running Meta Box 5.15.2 or earlier are exposed only if a plugin or theme built on Meta Box lets lower-privileged users set the background field and then displays it without escaping. The sources demonstrate the attack at subscriber level, so the effective required role depends on what the consuming code permits. Sites without such a consumer, or where only administrators can edit that field, are less exposed.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00074,"input_tokens":4303,"output_tokens":619,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109216':13A,16A '-2026':12A,15A '/format_single_value':175C '5.15.2':34B,104C 'access':57B,124C,140C 'affect':71B 'anyon':67B 'arbitrari':129C 'attack':119C 'authent':51B,118C 'background':9A,42B,95C,159C 'box':2A,19B,27B,75C,155C 'browser':65B 'built':152C 'consum':148C,185C 'contain':48B 'cross':89C 'cross-sit':88C 'cve':11A,14A 'demonstr':187C 'depend':145C 'due':105C 'dynam':79C 'effect':178C 'escap':39B,112C 'execut':136C 'exploit':144C 'expos':157C 'field':160C 'framework':77C 'host':23B 'includ':33B,103C 'inject':59B,128C,142C 'input':108C 'insuffici':107C 'javascript':60B 'level':56B,123C,190C 'lower':163C 'lower-privileg':162C 'make':114C 'meta':1A,18B,26B,74C,154C 'meta-box':17B 'minimum':179C 'output':111C 'packag':20B 'page':72B,133C,143C 'paramet':10A,43B,96C 'pattern':176C 'permit':186C 'plugin':4A,29B,81C,149C 'possibl':116C 'privileg':164C,180C 'profil':8A,41B,94C 'render':167C 'role':183C 'run':62B 'rwmb':172C 'sanit':37B,109C 'script':49B,91C,131C 'self':22B 'self-host':21B 'site':90C 'store':5A,45B,87C,168C 'subscrib':55B,122C,189C 'subscriber-level':54B,121C 'theme':151C 'user':52B,139C,165C 'valu':46B,169C,174C 'version':99C 'via':7A,92C,170C 'view':69B 'vulner':85C 'web':130C 'websit':80C 'whatev':182C 'whenev':137C 'wordpress':3A,24B,28B,83C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running Meta Box 5.15.2 or earlier are exposed only if a plugin or theme built on Meta Box lets lower-privileged users set the background field and then displays it without escaping. The sources demonstrate the attack at subscriber level, so the effective required role depends on what the consuming code permits. Sites without such a consumer, or where only administrators can edit that field, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T12:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109216","severity":null,"published_at":"2026-10-29T12:17:09+00:00","modified_at":"2026-10-29T12:17:09+00:00","first_seen_at":"2026-10-29T12:24:38+00:00","fetched_at":"2026-10-29T12:24:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}