What is the CVSS score of CVE-2026-9643?

CVE-2026-9643 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of WP Meta SEO are affected by CVE-2026-9643?

WP Meta SEO plugin versions 4.5.18 and earlier contain an unauthenticated stored cross-site scripting vulnerability that allows remote attackers to inject malicious JavaScript into WordPress…

How to fix or mitigate CVE-2026-9643?

Within 24 hours: Audit all WordPress instances for WP Meta SEO plugin installations (versions ≤ 4.5.18); document affected sites and identify dependent functionality. Within 7 days: Deactivate and remove the vulnerable plugin from all WordPress installations; evaluate and deploy alternative SEO management solutions. Within 30 days: Audit WordPress administrator accounts for unauthorized access or modifications; establish plugin inventory and security review process; monitor vendor advisories for patch availability.

WP Meta SEO CVE-2026-9643

EUVD-2026-38678 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-24 Wordfence

GHSA-qhjr-7q98-w4h3

PHP XSS WordPress Wp Meta Seo

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Unauthenticated network injection (AV:N/AC:L/PR:N); UI:R because payload only fires when an admin opens the broken-link page; S:C and C:L/I:L for admin-session XSS impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 06:51 vuln.today

CVE Published

Jun 24, 2026 - 05:33 cve.org

HIGH 7.2

DescriptionCVE.org

The WP Meta SEO plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REQUEST_URI server variable in all versions up to, and including, 4.5.18. When the plugin's wpmsTemplateRedirect() hook detects a 404, it concatenates $_SERVER['HTTP_HOST'] with the raw $_SERVER['REQUEST_URI'] and inserts that value verbatim into the wp_wpms_links.link_url column via $wpdb->insert(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever an administrator views the plugin's 404 & Redirects admin page (/wp-admin/admin.php?page=metaseo_broken_link).

Articles & Coverage 2

News 8 New PHP Vulnerabilities - 1 Critical, 7 High, 2 With POC Jun 25, 2026 News 18 New WordPress Vulnerabilities - 2 Critical, 6 With POC Jun 25, 2026

AnalysisAI

Unauthenticated stored cross-site scripting in the WP Meta SEO WordPress plugin (versions ≤ 4.5.18 by Joomunited) lets remote attackers persist arbitrary JavaScript into the wp_wpms_links.link_url database column by sending HTTP requests with a malicious URI to any 404 path. The payload executes in the browser of any administrator who opens the plugin's '404 & Redirects' admin page, enabling session hijacking or admin-on-behalf actions. No public exploit identified at time of analysis; no KEV listing.

Technical ContextAI

WP Meta SEO is a WordPress SEO/redirects plugin distributed by Joomunited (CPE cpe:2.3:a:joomunited:wp_meta_seo). The flaw is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) realized via unsafe persistence: the wpmsTemplateRedirect() hook in wp-meta-seo.php triggers on 404 responses and concatenates $_SERVER['HTTP_HOST'] with the raw, attacker-controlled $_SERVER['REQUEST_URI'], then writes the string verbatim into the database through $wpdb->insert(). Because $wpdb->insert() only parameterizes for SQL safety (not HTML/JS encoding), and the broken-links admin table renders the stored value without output escaping (inc/class.metaseo-broken-link-table.php referenced in the advisory), the unsanitized payload reaches an authenticated administrator's DOM unchanged.

RemediationAI

Upstream fix available (referenced via plugins.trac.wordpress.org changeset between tags 4.5.12 and 4.5.13); a released patched version covering 4.5.18 is not independently confirmed in the supplied data, so upgrade to the latest WP Meta SEO release available on the WordPress.org plugin directory and verify the installed version is greater than 4.5.18 before considering the issue closed. Consult the Wordfence advisories (https://www.wordfence.com/threat-intel/vulnerabilities/id/beceb218-34bf-4571-a07b-939abc7ead8e?source=cve and https://ti.wordfence.io/vulnerabilities/ca91e41d-b728-4eb0-86d5-043813d8c2c1) for the fixed version number once published. If immediate patching is not possible, deactivate the WP Meta SEO plugin (loses SEO and redirect-management functionality but eliminates the sink), or block administrator access to /wp-admin/admin.php?page=metaseo_broken_link via a WAF/.htaccess rule (admins lose visibility into broken links until patched), or truncate the wp_wpms_links table after each suspected attack window (manually deletes legitimate broken-link records as a side effect). A WAF rule that strips or rejects < and > characters in REQUEST_URI on 404 responses can also blunt the injection at the network edge, with the side effect of breaking any legitimate URLs containing those characters.