{"id":"CVE-2026-123472","kind":"vulnerability","aliases":["CVE-2026-123472"],"related":[],"title":"Meta Box WordPress plugin: stored XSS through custom fields framework","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Stored XSS.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.3.","summary":"Meta Box, a WordPress custom fields framework, does not neutralize input properly, so stored cross-site scripting is possible. An attacker who can get a malicious value saved can run script in the browser of anyone who later views the affected page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["meta-box","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the Meta Box plugin is installed and its version in the WordPress admin under Plugins.\n- Compare the installed version against `5.15.3`; versions through `5.15.3` are listed as affected.","fix":null,"status":"open","published_at":"2026-11-07T18:17:21+00:00","first_seen_at":"2026-11-07T18:48:29+00:00","triaged_at":"2026-11-07T18:50:00+00:00","updated_at":"2026-11-07T18:50:00+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T18:50:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Meta Box WordPress plugin: stored XSS through custom fields framework","impact":"medium","summary":"Meta Box, a WordPress custom fields framework, does not neutralize input properly, so stored cross-site scripting is possible. An attacker who can get a malicious value saved can run script in the browser of anyone who later views the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","meta-box","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script runs in visitors' browsers, enabling session theft or actions as them.","analyst_note":"Confirm the fixed version and the required privilege level for storing the payload from the vendor or NVD advisory.","how_to_check":"- Check whether the Meta Box plugin is installed and its version in the WordPress admin under Plugins.\n- Compare the installed version against `5.15.3`; versions through `5.15.3` are listed as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Meta Box WordPress plugin at version 5.15.3 or earlier are listed as affected. The source does not say which user roles can store the malicious input, so the exposure depends on who can submit data to the site. Sites that do not use the plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":4245,"output_tokens":531,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123472':13A,16A '-2026':12A,15A '5.15.3':106C 'affect':66B,96C 'allow':92C 'anyon':61B 'attack':46B 'box':2A,19B,26B,84C,91C,98C 'browser':59B 'cross':40B,77C 'cross-sit':39B,76C 'custom':8A,29B,86C,100C 'cve':11A,14A 'elightup':82C 'field':9A,30B,87C,101C 'framework':10A,31B,88C,102C 'generat':75C 'get':49B 'host':23B 'improp':68C 'input':35B,71C 'issu':95C 'later':63B 'malici':51B 'meta':1A,18B,25B,83C,90C,97C 'meta-box':17B,89C 'n/a':104C 'neutral':34B,69C 'packag':20B 'page':67B,74C 'plugin':4A 'possibl':44B 'proper':36B 'run':55B 'save':53B 'script':42B,56B,79C 'self':22B 'self-host':21B 'site':41B,78C 'store':5A,38B,93C 'valu':52B 'view':64B 'vulner':80C 'web':73C 'wordpress':3A,24B,28B,85C,99C 'xss':6A 'xss.this':94C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Meta Box WordPress plugin at version 5.15.3 or earlier are listed as affected. The source does not say which user roles can store the malicious input, so the exposure depends on who can submit data to the site. Sites that do not use the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","metabox","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-123472':13A,16A '-2026':12A,15A 'box':2A 'custom':8A 'cve':11A,14A 'field':9A 'framework':10A 'meta':1A 'plugin':4A 'store':5A 'wordpress':3A 'xss':6A","search_b":"'affect':66B 'anyon':61B 'attack':46B 'box':19B,26B 'browser':59B 'cross':40B 'cross-sit':39B 'custom':29B 'field':30B 'framework':31B 'get':49B 'host':23B 'input':35B 'later':63B 'malici':51B 'meta':18B,25B 'meta-box':17B 'neutral':34B 'packag':20B 'page':67B 'possibl':44B 'proper':36B 'run':55B 'save':53B 'script':42B,56B 'self':22B 'self-host':21B 'site':41B 'store':38B 'valu':52B 'view':64B 'wordpress':24B,28B","search_c":"'5.15.3':106C 'affect':96C 'allow':92C 'box':84C,91C,98C 'cross':77C 'cross-sit':76C 'custom':86C,100C 'elightup':82C 'field':87C,101C 'framework':88C,102C 'generat':75C 'improp':68C 'input':71C 'issu':95C 'meta':83C,90C,97C 'meta-box':89C 'n/a':104C 'neutral':69C 'page':74C 'script':79C 'site':78C 'store':93C 'vulner':80C 'web':73C 'wordpress':85C,99C 'xss.this':94C","first_public_at":"2026-11-07T18:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123472","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123472","severity":null,"published_at":"2026-11-07T18:17:21+00:00","modified_at":"2026-11-07T18:17:21+00:00","first_seen_at":"2026-11-07T18:48:29+00:00","fetched_at":"2026-11-07T18:48:29+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}