ME
Vendor
metabox
6
CVEs
0
On KEV
1
New 30D
Products
MB4.9
Meta Box – A Framework for Dynamic Websites
metabox
1 CVEs0 on KEV1 new
MB7.5
Meta Box
metabox
5 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-109216 New | MB Meta Box – A Framework for Dynamic Websites metabox | 4.9 | Oct 29 | Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys |
| CVE-2025-14675 | MB Meta Box metabox | 7.2 | Mar 7 | Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion |
| CVE-2024-1204 | MB Meta Box Metabox | 4.3 | Apr 15 | Meta Box < 5.9.4 - Contributor+ Arbitrary Posts' Custom Field Disclosure |
| CVE-2023-6526 | MB Meta Box metabox | 5.4 | Feb 5 | Meta Box – WordPress Custom Fields Framework <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2019-14794 | MB Meta Box Metabox | 7.5 | Aug 9 | The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders |
| CVE-2019-14793 | MB Meta Box Metabox | 6.5 | Aug 9 | The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter |