CVE-2026-9643: WP Meta SEO Stored XSS in 404 Redirects Admin Page

Technical summary

The vulnerability exists in the wpmsTemplateRedirect() hook, which processes 404 errors. The plugin concatenates $_SERVER['HTTP_HOST'] with $_SERVER['REQUEST_URI'] and inserts the result directly into the wp_wpms_links.link_url database column using $wpdb->insert() without sanitization or escaping. An attacker can craft a malicious URL with embedded JavaScript payloads; when WordPress encounters the 404 and the plugin processes it, the payload is stored verbatim in the database. The attack vector leverages the fact that user-controlled HTTP headers and URI data are treated as trustworthy. When an administrator later loads the 404 & Redirects page at /wp-admin/admin.php?page=metaseo_broken_link, the stored script is rendered in the admin context without output encoding, enabling execution under the admin's session.

Business impact

This vulnerability poses a significant risk to WordPress site integrity and administrator security. Attackers can steal administrator session tokens, modify site content, create new admin accounts, inject malware, or exfiltrate sensitive data. Because the attack requires no authentication and the payload is persistent in the database, it affects all administrators who access the plugin's dashboard page, not just the attacker's session. Sites relying on WP Meta SEO for redirect management remain exposed until patched, and any malicious links already stored in the database could re-execute during administrator review.

Affected systems

All WordPress installations running WP Meta SEO plugin versions up to and including 4.5.18 are affected. The vulnerability is unauthenticated and can be triggered from any network location without requiring a WordPress account or credentials.

Exploitability

Exploitability is straightforward and does not require special conditions. An attacker simply crafts a malicious URL with embedded script tags and requests it from the vulnerable WordPress site. The 404 handling and database insertion occur automatically. No user interaction beyond normal site browsing is needed for the initial injection. The payload executes when administrators perform routine administrative tasks, making it a low-barrier attack with high impact in WordPress environments where administrators regularly manage redirects.

Remediation

Update WP Meta SEO to a patched version released after 4.5.18. Verify the patched version implements proper input validation and output encoding for all data derived from REQUEST_URI and HTTP_HOST. As an immediate interim measure, restrict administrator access to the 404 & Redirects page using role-based access controls or by disabling the plugin until a patch is available. Review the wp_wpms_links table for any suspicious URLs that may have been injected prior to patching.

Patch guidance

Check the official WP Meta SEO plugin repository and vendor advisories for the latest patched version. Apply updates through the WordPress admin dashboard or via your preferred package manager. After patching, verify the plugin version number and test that 404 handling and redirect management continue to function normally. Consider implementing a Web Application Firewall (WAF) rule that blocks requests containing script tags in the REQUEST_URI as a defense-in-depth measure.

Detection guidance

Monitor WordPress access logs for 404 requests containing common XSS payloads such as <script>, javascript:, onerror=, or onload= in the URI. Query the wp_wpms_links table for entries with suspicious patterns matching script injection attempts. Enable WordPress debug logging and monitor admin.php?page=metaseo_broken_link access by non-administrator accounts. Use security plugins that scan for stored XSS patterns in database values. Audit administrator session logs to identify any unauthorized activity following known exposure windows.

Why prioritize this

This vulnerability merits high priority because it combines unauthenticated injection with persistent storage, affecting administrator accounts directly. The CVSS 3.1 score of 7.2 reflects the severity: network-accessible, low complexity, no privileges required, and ability to compromise confidentiality and integrity across site boundaries. The lack of CISA KEV listing does not diminish the risk; active exploitation is likely given the ease of attack and the ubiquity of WordPress. Organizations running WP Meta SEO should treat this as urgent.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) is driven by network accessibility (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction needed for injection (UI:N), and cross-site scope impact (S:C). The attack compromises both confidentiality and integrity (C:L, I:L) but does not directly impact availability. Unauthenticated stored XSS in an admin-visible location justifies this severity rating. Organizations should not downgrade risk assessment based on lack of public exploit code or KEV listing; the vulnerability is straightforward to exploit and immediately actionable.

Frequently asked questions