plugin
12 known security issues reported for the Meta Box WordPress plugin. Most recent disclosed Aug 2, 2026.
Running Meta Box on your site? Check whether your installed version is affected.
Scan your site freeThe Meta Box plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to 5.13.1 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.
The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 5.11.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to...
Authenticated (Contributor+) Arbitrary File Deletion vulnerability
The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_delete_file' function in all versions up to, and including, 5.11.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on t...
[en] Missing Authorization vulnerability in MetaBox.Io Meta Box – WordPress Custom Fields Framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.9.10.
The Meta Box – WordPress Custom Fields Framework plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the query function called via 'ajax_get_posts' in versions up to, and including, 5.9.10. This makes it possible for authenticated attackers, with contributor-level acce...
[en] The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts.
The Meta Box – WordPress Custom Fields Framework plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 5.9.3. This is due to the plugin not properly restricting the post meta that can be displayed through the 'rwmb_meta' shortcode. This makes it possible for authenticated atta...
The Meta Box – WordPress Custom Fields Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta values displayed through the plugin's shortcode in all versions up to, and including, 5.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authe...
[en] The Meta Box – WordPress Custom Fields Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta values displayed through the plugin's shortcode in all versions up to, and including, 5.9.2 due to insufficient input sanitization and output escaping. This makes it possible for...
The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.
The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free