Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-123472 EUVD-2026-119323GHSA-cqgc-p4qg-hj32

WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Cross Site Scripting (XSS) vulnerability

Published Nov 7, 2026 · Updated Nov 7, 2026 · Assigned by Patchstack

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Stored XSS.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.3.

Affected products

VendorProductAffectedFixed
eLightUp Meta Box – WordPress Custom Fields Framework ≤ 5.15.3 —

References