Description
The Meta Display Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Meta Display Block in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2025-11-18
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting
Action: Apply Patch
AI Analysis

Impact

The Meta Display Block plugin for WordPress contains an input sanitization flaw that permits stored XSS. Authenticated users with Contributor level or higher can inject malicious scripts that execute for any visitor to the affected page, enabling defacement, credential theft, or redirection. The weakness is classified as CWE‑79.

Affected Systems

The vulnerable product is the Meta Display Block plugin by bhargavbhandari90. All releases up to and including version 1.0.0 are affected; newer releases may contain a patch. WordPress sites that have installed the plugin and grant Contributor or higher roles are at risk.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate severity, while an EPSS score of < 1 % suggests a low current exploitation probability and the vulnerability is not listed in the CISA KEV catalog. However, because any authenticated contributor can inject scripts, the potential impact is broad. Attackers would require legitimate Contributor credentials, typically supplied by site administrators, to exploit this flaw. Remediation is therefore advisable even if exploitation currently appears low.

Generated by OpenCVE AI on April 22, 2026 at 11:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Meta Display Block plugin to the newest release that contains the XSS fix.
  • If an update cannot be applied immediately, deactivate or remove the plugin to eliminate the injection vector.
  • Audit existing content for injected scripts and purge any malicious code before re‑enabling the plugin or granting Contributor permissions.

Generated by OpenCVE AI on April 22, 2026 at 11:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Nov 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Nov 2025 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Tue, 18 Nov 2025 09:45:00 +0000

Type Values Removed Values Added
Description The Meta Display Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Meta Display Block in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title Meta Display Block <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:58:24.016Z

Reserved: 2025-10-22T18:16:14.673Z

Link: CVE-2025-12088

cve-icon Vulnrichment

Updated: 2025-11-18T21:01:17.276Z

cve-icon NVD

Status : Deferred

Published: 2025-11-18T10:15:47.023

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-12088

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T12:00:05Z

Weaknesses