Skip to content
OpenAdvisories

Vendor

Meta Box

5 known vulnerabilities.

Meta Box at a glance

Last 12 months
4
Critical · all time
2
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 1 vulnerability Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 1 vulnerability, 1 critical August 2026: 0 vulnerabilities September 2026: 1 vulnerability, 1 critical Sep October 2026: 1 vulnerability November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202610
Sep 202611
Aug 202600
Jul 202611
Jun 202600
May 202600
Apr 202600
Mar 202610
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Meta Box 2 Meta Box Frontend Submission 1 Meta Box – A Framework for Dynamic Websites 1 Meta Box AIO 1
All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Medium 4.9
    CVE-2026-109216

    Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys

    The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profile_background[<attacker-chosen key>]' parameter in all versions up to, and including, 5.15.2 due to insufficient input sanitization…

    Meta Box Meta Box – A Framework for Dynamic Websites Web / CMS
  • Critical 9.8
    CVE-2026-13355 Public exploit

    Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter

    The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populate_via_query_string() function in the mb-frontend-submission component unconditiona…

    Meta Box Meta Box Frontend Submission Web / CMS
  • Critical 9.1
    CVE-2026-14488

    Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter

    The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handle_request() function routing the mbfs_de…

    Meta Box Meta Box AIO Web / CMS
  • High 7.2
    CVE-2025-14675

    Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion

    The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_delete_file' function in all versions up to, and including, 5.11.1. This makes it possible for authenticated attackers, with Contr…

    Meta Box Meta Box wpmetabox/meta-box Web / CMS Packagist
  • Medium 6.4
    CVE-2023-6526

    Meta Box – WordPress Custom Fields Framework <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Meta Box – WordPress Custom Fields Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta values displayed through the plugin's shortcode in all versions up to, and including, 5.9.2 due to insufficient input sanit…

    Meta Box Meta Box Web / CMS