CVE-2026-9643 WP Meta SEO <= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Logging
HighCVSS 7.2
EPSS 0.42%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The WP Meta SEO plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REQUEST_URI server variable in all versions up to, and including, 4.5.18. When the plugin's wpmsTemplateRedirect() hook detects a 404, it concatenates $_SERVER['HTTP_HOST'] with the raw $_SERVER['REQUEST_URI'] and inserts that value verbatim into the wp_wpms_links.link_url column via $wpdb->insert(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever an administrator views the plugin's 404 & Redirects admin page (/wp-admin/admin.php?page=metaseo_broken_link).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| JoomUnited WP Meta SEO | <= 4.5.18 | No fix listed |
| wordpress wp-meta-seo(WordPress) | <= 4.5.18 | No fix listed |