Executive brief
WP Meta SEO is a WordPress plugin used to manage search engine optimization and monitor broken links. A security flaw allows unauthenticated visitors to inject malicious scripts into the plugin's database by simply visiting a non-existent page on the site. These scripts are then executed in the browser of a site administrator when they view the plugin's broken link report, potentially leading to unauthorized administrative actions or site takeover.
Technical details
The vulnerability is a stored Cross-Site Scripting (XSS) issue within the wpmsTemplateRedirect() hook. When the plugin detects a 404 error, it captures the raw $_SERVER['REQUEST_URI'] and concatenates it with $_SERVER['HTTP_HOST'], inserting the resulting string directly into the wp_wpms_links.link_url database column without sanitization. Because this data is later rendered without escaping on the '404 & Redirects' admin page, an unauthenticated attacker can craft a URL containing a malicious payload. When an administrator accesses the report at /wp-admin/admin.php?page=metaseo_broken_link, the payload executes in their session context. The issue is addressed in versions following 4.5.18.
Affected products
- JoomUnited WP Meta SEO up to, and including, 4.5.18
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://plugins.trac.wordpress.org/browser/wp-meta-seo/tags/4.5.18/inc/class.metaseo-broken-link-table.php
- https://plugins.trac.wordpress.org/browser/wp-meta-seo/tags/4.5.18/wp-meta-seo.php
- https://plugins.trac.wordpress.org/browser/wp-meta-seo/tags/4.5.18/wp-meta-seo.php
- https://plugins.trac.wordpress.org/changeset?old_path=/wp-meta-seo/tags/4.5.12&new_path=/wp-meta-seo/tags/4.5.13
- https://ti.wordfence.io/vulnerabilities/ca91e41d-b728-4eb0-86d5-043813d8c2c1
- https://www.wordfence.com/threat-intel/vulnerabilities/id/beceb218-34bf-4571-a07b-939abc7ead8e?source=cve