eLightUp vulnerabilities

Products

• Meta Box – WordPress Custom Fields Framework 4
• eRocket 1
• Falcon – WordPress Optimizations & Tweaks 1
• Meta Box AIO 1
• Slim SEO 1

Latest eLightUp CVEs

Newest publication first

1. CVE-2026-123472 WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Cross Site Scripting (XSS) vulnerability

   Published 2026-11-07

   Medium·CVSS 6.5 EPSS 0.18%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Stored XSS.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.3.

2. CVE-2026-120836 WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Broken Access Control vulnerability

   Published 2026-11-07

   Medium·CVSS 6.5 EPSS 0.29%

   Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.3.

3. CVE-2026-112826 WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.12.0 - Broken Access Control vulnerability

   Published 2026-10-22

   Medium·CVSS 5.3 EPSS 0.28%

   Missing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Falcon – WordPress Optimizations & Tweaks: from n/a through 2.12.0.

4. CVE-2026-109700 WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.2 - Broken Access Control vulnerability

   Published 2026-10-20

   Medium·CVSS 6.5 EPSS 0.32%

   Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2.

5. CVE-2026-39761 WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability

   Published 2026-10-06

   Critical·CVSS 9.8 EPSS 0.44%

   Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.

6. CVE-2026-57429 WordPress Slim SEO plugin <= 4.6.2 - Broken Access Control vulnerability

   Published 2026-06-25

   Medium·CVSS 6.5 EPSS 0.34%

   Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.

7. CVE-2026-39468 WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.11.1 - Arbitrary File Deletion vulnerability

   Published 2026-06-15

   Medium·CVSS 6.8 EPSS 1.2%

   Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions.

8. CVE-2023-28174 WordPress eRocket Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-06-22

   Medium·CVSS 4.8 EPSS 0.39%

   Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in eLightUp eRocket plugin <= 1.2.4 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.