Is CVE-2026-9643 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9643 being exploited in the wild.

How severe is CVE-2026-9643?

High severity, with a CVSS score of 7.2, published 24 June 2026.

Which products and versions are affected?

JoomUnited WP Meta SEO up to, and including, 4.5.18.

Is there a fix for CVE-2026-9643?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9643 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-9643?

Check whether you run JoomUnited WP Meta SEO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9643: JoomUnited WP Meta SEO unauthenticated stored XSS in 404 handler

CVE-2026-9643 · Severity: high · CVSS 7.2 · Published 2026-06-24

WP Meta SEO is a WordPress plugin used to manage search engine optimization and monitor broken links. A security flaw allows unauthenticated visitors to inject malicious scripts into the plugin's database by simply visiting a non-existent page on the site. These scripts are then executed in the browser of a site administrator when they view the plugin's broken link report, potentially leading to unauthorized administrative actions or site takeover.

Vendors: JoomUnited.

Quick answers

Is CVE-2026-9643 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9643 being exploited in the wild.
How severe is CVE-2026-9643?: High severity, with a CVSS score of 7.2, published 24 June 2026.
Which products and versions are affected?: JoomUnited WP Meta SEO up to, and including, 4.5.18.
Is there a fix for CVE-2026-9643?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9643 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-9643?: Check whether you run JoomUnited WP Meta SEO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored Cross-Site Scripting (XSS) issue within the wpmsTemplateRedirect() hook. When the plugin detects a 404 error, it captures the raw $_SERVER['REQUEST_URI'] and concatenates it with $_SERVER['HTTP_HOST'], inserting the resulting string directly into the wp_wpms_links.link_url database column without sanitization. Because this data is later rendered without escaping on the '404 & Redirects' admin page, an unauthenticated attacker can craft a URL containing a malicious payload. When an administrator accesses the report at /wp-admin/admin.php?page=metaseo_broken_link, the payload executes in their session context. The issue is addressed in versions following 4.5.18.

Affected products

JoomUnited WP Meta SEO up to, and including, 4.5.18

Timeline

2026-06-24: disclosed
2026-06-24: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.