Executive brief
JSM Show Post Metadata is a WordPress plugin that displays custom field information on posts. The plugin fails to properly escape post meta keys before inserting them into an admin event handler, allowing contributors and higher-privileged users to inject malicious JavaScript that runs when administrators view affected posts, potentially leading to account compromise or unauthorized actions.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the plugin's meta box functionality where post meta keys are output unsanitized into inline event-handler attributes. An authenticated attacker with contributor-level access can inject arbitrary JavaScript into a custom field meta key that will execute when a higher-privileged administrator loads the post editor. The vulnerability was fixed in version 4.9.1.
Affected products
- JSM Show Post Metadata before 4.9.1
Timeline
- 2026-09-21: disclosed
- 2026-09-21: patched: Fixed in version 4.9.1