WP Meta SEO <= 4.5.18 Unauthenticated Stored XSS via REQUEST_URI (CVE-2026-9643)

Vulnerability Overview Vulnerability Name: WP Meta SEO <= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Logging CVE ID: CVE-2026-9643 CVSS Score: 7.2 (High) Release Date: June 23, 2026 Last Updated: June 24, 2026 Researcher: zdedq - dnoz/zdedq Affected Software Software Type: Plugin Software Name: wp-meta-seo Affected Versions: <= 4.5.18 Patch Status: No known patch Remediation Recommended Action: Review the vulnerability details in detail and implement mitigation measures based on your organization's risk tolerance. It may be necessary to uninstall the affected software and seek an alternative. Vulnerability Description The WP Meta SEO plugin for WordPress is vulnerable to an unauthenticated stored cross-site scripting (XSS) attack. When the plugin's hook detects a 404 error, it concatenates with the raw and inserts this value into the column via . This allows unauthenticated attackers to inject arbitrary web scripts, which are executed whenever an administrator views the plugin's 404 and redirects management page. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org ti.wordfence.io Related Vulnerabilities WP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter - CVE ID: CVE-2026-11370 - CVSS Score: 6.4 - Researcher: Enes Ismail - Date: June 23, 2026 WP Meta SEO <= 4.5.13 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2024-45456 - CVSS Score: 6.4 - Researcher: Robert DeVore - Date: September 12, 2024 WP Meta SEO <= 4.5.13 - Authenticated (Administrator+) Stored Cross-Site Scripting - CVE ID: CVE-2024-45455 - CVSS Score: 4.4 - Researcher: Robert DeVore - Date: September 12, 2024 WP Meta SEO <= 4.5.12 - Unauthenticated Stored Cross-Site Scripting via Referrer header - CVE ID: CVE-2023-6961 - CVSS Score: 7.2 - Researcher: Krzysztof Zając - Date: April 16, 2024 WP Meta SEO <= 4.5.12 - Information Exposure via Meta Description - CVE ID: CVE-2023-6962 - CVSS Score: 5.3 - Researcher: Krzysztof Zając - Date: April 16, 2024 WP Meta SEO <= 4.5.4 - Authenticated (Author) PHAR Deserialization - CVE ID: CVE-2023-1381 - CVSS Score: 8.8 - Researcher: Alex Sanford - Date: March 27, 2023 WP Meta SEO <= 4.5.3 - Missing Authorization in 'wpmiSGSaveInformation' - CVE ID: CVE-2023-1022 - CVSS Score: 5.4 - Researcher: Marco Wotschka - Date: February 24, 2023 WP Meta SEO <= 4.5.3 - Missing Authorization in 'saveSitemapSettings' - CVE ID: CVE-2023-1023 - CVSS Score: 5.4 - Researcher: Marco Wotschka - Date: February 24, 2023 WP Meta SEO <= 4.5.3 - Missing Authorization in 'listPostsCategory' - CVE ID: CVE-2023-1026 - CVSS Score: 4.3 - Researcher: Marco Wotschka - Date: February 24, 2023 WP Meta SEO <= 4.5.3 - Cross-Site Request Forgery via 'setlink' - CVE ID: CVE-2023-1028 - CVSS Score: 4.3 - Researcher: Marco Wotschka - Date: February 24, 2023 Additional Information Wordfence Intelligence: Provides free personal and commercial API access to a comprehensive WordPress vulnerability database, as well as free webhook integration to stay updated on newly added vulnerabilities in the database. Wordfence WordPress Vulnerability Database: Offers fully free access and query API. Please consult the documentation for instructions on how to access and consume vulnerability data. Footer Information Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT, excluding weekends and holidays. Response Time: 365 days a year, 1-hour response time. Terms of Service: Privacy Policy and Collection Notice. We do not sell or share my personal information. Contact Email: support@wordfence.com Social Media: Twitter, Facebook, LinkedIn, Instagram Copyright Information Copyright: © 2012-2026 Defiant Inc. All rights reserved.

Goal Reached Thanks to every supporter — we hit 100%!

WP Meta SEO <= 4.5.18 Unauthenticated Stored XSS via REQUEST_URI (CVE-2026-9643)

More from this source