CVE-2023-1661 in Display Meta Plugin
Summary
by MITRE • 05/31/2023
The Display post meta, term meta, comment meta, and user meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post metadata in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/09/2026
The vulnerability identified as CVE-2023-1661 affects the Display post meta, term meta, comment meta, and user meta plugin for WordPress, representing a critical security flaw that undermines the platform's integrity. This issue exists in versions up to and including 1.0.0, where the plugin fails to properly sanitize user input or escape output data. The vulnerability stems from inadequate validation mechanisms that allow malicious actors to inject harmful scripts into metadata fields, creating persistent threats that can affect all users who interact with compromised content. The flaw specifically targets the plugin's handling of metadata inputs, which are typically used to store additional information about posts, terms, comments, and user accounts.
The technical implementation of this vulnerability enables authenticated attackers with contributor-level permissions or higher to execute stored cross-site scripting attacks against the WordPress installation. When an attacker submits malicious input through metadata fields, the system stores this data without proper sanitization, creating a persistent script injection vector. The vulnerability operates at the application layer, specifically within the plugin's data handling routines, and leverages the trust relationship between the WordPress platform and its users. This type of flaw falls under CWE-79, which describes Cross-Site Scripting vulnerabilities, and represents a classic case of insufficient output escaping where user-supplied data is directly rendered without proper sanitization. The attack chain begins with an authenticated user gaining access to metadata fields, submitting malicious content, and then waiting for other users to view pages containing the injected scripts.
The operational impact of this vulnerability extends beyond simple script execution, as it creates potential for more sophisticated attacks including session hijacking, credential theft, and data exfiltration. When users access pages containing the injected scripts, their browsers execute the malicious code in the context of the vulnerable WordPress installation, potentially allowing attackers to access sensitive information or perform unauthorized actions. The vulnerability affects all user roles with contributor permissions and above, which means that any user who can modify content or metadata fields represents a potential threat vector. This creates a significant risk for WordPress installations where multiple contributors have access to the platform, as these users can inadvertently or maliciously compromise the entire system. The stored nature of the XSS attack means that the malicious scripts remain active until manually removed, creating persistent threats that can affect users over extended periods.
Organizations and WordPress administrators should prioritize immediate mitigation strategies to protect their installations from exploitation of this vulnerability. The most effective immediate solution involves updating to the latest version of the plugin where the vulnerability has been patched, as this addresses the root cause of the insufficient input sanitization and output escaping. Additionally, implementing proper input validation and output escaping mechanisms at the application level can help prevent similar issues in the future. Security monitoring should be enhanced to detect unusual metadata modifications, and access controls should be reviewed to ensure that only trusted users have contributor-level permissions or higher. The vulnerability demonstrates the importance of following secure coding practices as outlined in the OWASP Top Ten and aligns with ATT&CK technique T1566, which covers the use of malicious content to gain initial access or maintain persistence. Regular security audits and penetration testing should be conducted to identify similar vulnerabilities in other plugins and themes, as this particular flaw highlights the need for comprehensive input validation across all user-supplied data handling within WordPress installations.