Unauthenticated Stored Cross-Site Scripting in WP Meta SEO Plugin for WordPress

CVE-2026-9643

What is CVE-2026-9643?

The WP Meta SEO plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit stored cross-site scripting (XSS) via the REQUEST_URI server variable. This occurs in all versions up to and including 4.5.18. Specifically, when the plugin detects a 404 error, it mishandles user input by directly incorporating the HTTP_HOST and REQUEST_URI values into a database entry without proper sanitization. As a result, an attacker can inject malicious scripts that may execute whenever an admin accesses the related 404 & Redirects admin page, posing significant risks to website security.

References