CVE-2026-123472: WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Cross Site Scripting (XSS) vulnerability
Published Nov 7, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Stored XSS.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.3.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
eLightUp Meta Box – WordPress Custom Fields Frameworkto a version that resolves this vulnerability.Fixed in 5.15.4
Event History
Nov 7, 2026
CVE Published
via MITRE·05:26 PM
Data Sourced
via MITRE·05:26 PM
RemedyDescriptionSeverityWeakness