CVE-2023-6526 in Meta Box Plugin
Summary
by MITRE • 02/06/2024
The Meta Box – WordPress Custom Fields Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta values displayed through the plugin's shortcode in all versions up to, and including, 5.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/11/2026
The vulnerability identified as CVE-2023-6526 affects the Meta Box WordPress plugin, specifically targeting versions up to and including 5.9.2. This plugin serves as a framework for creating custom fields within WordPress environments, making it a critical component for many WordPress installations that require extended content management capabilities. The vulnerability resides in how the plugin handles custom post meta values that are displayed through its shortcode functionality, creating a pathway for malicious script injection that can compromise user sessions and data integrity across affected WordPress sites.
The technical flaw stems from inadequate input sanitization and insufficient output escaping mechanisms within the plugin's codebase. When administrators or users with contributor-level privileges and above create or modify custom post meta values, the plugin fails to properly validate or sanitize these inputs before rendering them in web pages. This weakness allows attackers to inject malicious JavaScript code through the meta value fields, which then gets executed whenever legitimate users access pages containing the vulnerable shortcode output. The vulnerability specifically impacts the plugin's shortcode rendering functionality, where user-generated content is directly embedded into web pages without proper security measures to prevent script execution.
The operational impact of this stored cross-site scripting vulnerability is significant for WordPress environments utilizing the affected Meta Box plugin. Authenticated attackers with contributor-level access can exploit this weakness to execute arbitrary scripts in the context of any user who views the compromised pages, potentially leading to session hijacking, data theft, or further compromise of the WordPress installation. The vulnerability affects all users who have access to pages displaying the plugin's shortcode output, making it particularly dangerous in multi-user environments where contributors and editors may have access to sensitive content management features. This threat vector enables attackers to establish persistent access to WordPress sites and potentially escalate their privileges within the affected environments.
Security mitigations for CVE-2023-6526 should prioritize immediate plugin updates to versions that address the sanitization and escaping deficiencies. Organizations should implement strict input validation measures at multiple levels, ensuring that all user-generated content is properly escaped before display in web pages. Network monitoring should be enhanced to detect suspicious script injection patterns, and access controls should be reviewed to minimize the number of users with contributor-level privileges. The vulnerability aligns with CWE-79, which describes cross-site scripting flaws, and represents a typical attack pattern categorized under ATT&CK technique T1566 for initial access through malicious content. Regular security audits of WordPress plugins and core systems remain essential for identifying similar vulnerabilities, while implementing Content Security Policy headers can provide additional protection against script execution in compromised environments.