Stored Cross-Site Scripting Vulnerability in Meta Box Plugin for WordPress

CVE-2026-109216

What is CVE-2026-109216?

The Meta Box plugin for WordPress exhibits a vulnerability that permits stored cross-site scripting (XSS) due to inadequate input sanitization and output escaping. Specifically, the issue arises through the 'profile_background[]' parameter across all versions up to and including 5.15.2. Authenticated users with subscriber-level access can exploit this flaw, allowing them to inject arbitrary web scripts into web pages that execute when accessed. The severity of the exploitability hinges on the configuration of any consuming plugin or theme leveraging Meta Box and displaying values through specific functions. The vulnerability reveals that even lower-privileged users may be exposed to attack vectors facilitated by inadequate controls in the application.

References