CVE-2026-9643

Name of the Vulnerable Software and Affected Versions WP Meta SEO versions prior to 4.5.19

Description Unauthenticated Stored Cross-Site Scripting occurs when the wpmsTemplateRedirect() hook detects a 404 error. The plugin concatenates $ SERVER['HTTP HOST'] with the raw $ SERVER['REQUEST URI'] and inserts the value into the wp wpms links.link url column using $wpdb->insert(). This allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrator accesses the 404 & Redirects admin page at the endpoint '/wp-admin/admin.php?page=metaseo broken link'.

Recommendations Update to a version newer than 4.5.18.