CVE-2026-109216: Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys
The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profilebackground[<attacker-chosen key>]' parameter in all versions up to, and including, 5.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitability depends on a consuming plugin or theme built on Meta Box that exposes the background field to lower-privileged users and renders stored values via the rwmbthevalue()/formatsinglevalue() pattern; the effective minimum privilege is whatever role that consumer permits, demonstrated at Subscriber level.
Affected Software
Event History
Frequently Asked Questions
Are all sites using this plugin exploitable?
No. Exploitation depends on a plugin or theme consuming Meta Box that exposes the background field to lower-privileged users and renders the stored value through the rwmb_the_value()/format_single_value() pattern.
What access does an attacker need?
The attacker must be authenticated and have access to the relevant background field. Subscriber-level exploitation was demonstrated, but the effective minimum role is determined by the consuming plugin or theme's permissions.
How can I determine whether my site is exposed?
Check whether Meta Box is version 5.15.2 or earlier, then identify themes or plugins that expose profile_background array input to lower-privileged users. Confirm whether those components render the saved value using rwmb_the_value() or format_single_value().
What is the impact if exploitation succeeds?
An attacker can store arbitrary web script in an affected page. The script executes when another user accesses that injected page, with potential confidentiality and integrity impact.