Skip to content
Noroxi

Meta Box – A Framework for Dynamic Websites

meta-box · plugin

Known security vulnerabilities for Meta Box – A Framework for Dynamic Websites. Find out in seconds which version runs on your site with WP Lens.

4 known vulnerabilities

2 with public exploit code · latest Jun 15, 2026

Listed on wordpress.org · latest 5.15.1 · last updated Sep 17, 2026 · 500K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2025-14675contributor+≤ 5.11.1

    Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion

    High 7.2

  • CVE-2024-43235login required≤ 5.9.10

    WordPress Meta Box plugin <= 5.9.10 - Broken Access Control vulnerability

    High 7.1

  • CVE-2026-39468contributor+≤ 5.11.1

    WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.11.1 - Arbitrary File Deletion vulnerability

    Medium 6.8

  • CVE-2023-6526contributor+≤ 5.9.2

    Meta Box – WordPress Custom Fields Framework <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory