CVE-2026-109216

The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profile_background[<attacker-chosen key>]' parameter in all versions up to, and including, 5.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitability depends on a consuming plugin or theme built on Meta Box that exposes the background field to lower-privileged users and renders stored values via the rwmb_the_value()/format_single_value() pattern; the effective minimum privilege is whatever role that consumer permits, demonstrated at Subscriber level.

• CWE-79

• https://github.com/wpmetabox/meta-box/pull/1709
• https://plugins.trac.wordpress.org/browser/meta-box/tags/5.15.2/inc/fields/background.php#L154
• https://plugins.trac.wordpress.org/browser/meta-box/tags/5.15.2/inc/sanitizer.php#L170
• https://plugins.trac.wordpress.org/browser/meta-box/tags/5.15.3/inc/fields/background.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7a8948f5-8bcf-48f2-b3a6-bfa24ba9bef0?source=cve

Published

Oct 29, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-109207The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, N…7.2
• CVE-2026-109208The LearnPress – WordPress LMS Plugin for Create and Sell On…7.2
• CVE-2026-109209The All-in-One Video Gallery – Video Player & Galleries for …6.4
• CVE-2026-10921Integer overflow in Dawn in Google Chrome prior to 149.0.782…8.3
• CVE-2026-109213Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-109215The LiteSpeed Cache plugin for WordPress is vulnerable to St…6.4
• CVE-2026-109217The PDF Invoices & Packing Slips for WooCommerce plugin for …5.3
• CVE-2026-109218The Contact Manager plugin for WordPress is vulnerable to Ar…9.8
• CVE-2026-109219The Mang Board plugin for WordPress is vulnerable to Arbitra…9.8
• CVE-2026-10922Insufficient validation of untrusted input in DevTools in Go…8.8
• CVE-2026-109220The PDF Invoice for WooCommerce + Drag and Drop Template Bui…9.8
• CVE-2026-109221The Groundhogg — CRM, Newsletters, and Marketing Automation …8.1