metabox
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Meta Box | 2 | – | Mar 7, 2026 |
| Meta Box – A Framework for Dynamic Websites | 1 | – | Oct 29, 2026 |
Exploited and recent CVEs
- CVE-2026-109216 Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys 0.2%
- CVE-2025-14675 Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion 2.7%
- CVE-2023-6526 Meta Box – WordPress Custom Fields Framework <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.4%