CVE-2026-9643: WP Meta SEO Plugin XSS Vulnerability

CVE-2026-9643 Overview

CVE-2026-9643 is an unauthenticated stored Cross-Site Scripting (XSS) vulnerability in the WP Meta SEO plugin for WordPress, affecting all versions up to and including 4.5.18. The flaw exists in the plugin's 404 handling logic, which writes attacker-controlled request data directly into the database without sanitization. The injected payload executes when an administrator opens the plugin's 404 & Redirects admin page at /wp-admin/admin.php?page=metaseo_broken_link. The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in an authenticated administrator's browser session, enabling account takeover, malicious redirect creation, or further compromise of the WordPress site.

Affected Products

WP Meta SEO plugin for WordPress — all versions up to and including 4.5.18
WordPress sites with the wpmsTemplateRedirect() 404 handler enabled
Administrative interface at /wp-admin/admin.php?page=metaseo_broken_link

Discovery Timeline

2026-06-24 - CVE-2026-9643 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-9643

Vulnerability Analysis

The vulnerability resides in the wpmsTemplateRedirect() hook of the WP Meta SEO plugin. When WordPress returns a 404 response for a requested resource, the hook records the broken link into the wp_wpms_links table for administrator review. The plugin concatenates $_SERVER['HTTP_HOST'] with the raw, unsanitized $_SERVER['REQUEST_URI'] and writes the resulting string into the link_url column through $wpdb->insert().

Because REQUEST_URI is attacker-controlled and never escaped on input or output, any HTML or JavaScript embedded in the URI is stored verbatim. The malicious value is later rendered inside the plugin's broken link administration table without contextual escaping, triggering script execution in the browser of any administrator who views the page.

Root Cause

The root cause is a failure to sanitize untrusted input from server superglobals before persistence and a failure to escape stored values during output rendering. The plugin trusts $_SERVER['REQUEST_URI'] as a benign string, but this value reflects the raw HTTP request line and can contain arbitrary characters including HTML tags, quotes, and angle brackets. Combined with missing output encoding in the admin table, this produces a stored XSS sink directly in the privileged WordPress admin context.

Attack Vector

An unauthenticated attacker issues an HTTP request to any non-existent path on the target WordPress site, embedding a JavaScript payload in the URI. The plugin's 404 handler captures the URI and inserts it into the database. When an administrator subsequently navigates to the 404 & Redirects page, the browser parses and executes the stored payload under the admin's session, allowing actions such as creating new administrator accounts, modifying plugin settings, or exfiltrating session cookies.

The vulnerability mechanism is documented in the plugin source at the class.metaseo-broken-link-table.php handler and the wpmsTemplateRedirect insertion logic.

Detection Methods for CVE-2026-9643

Indicators of Compromise

Entries in the wp_wpms_links table where the link_url column contains HTML tags such as <script>, <img onerror=, <svg, or javascript: URIs.
Web server access logs showing 404 requests with URIs containing encoded or raw script syntax, for example %3Cscript%3E or <script>.
Unexpected creation of WordPress administrator accounts or modification of plugin settings shortly after an admin visited the 404 & Redirects page.

Detection Strategies

Query the wp_wpms_links table for suspicious link_url values: SELECT * FROM wp_wpms_links WHERE link_url REGEXP '<|javascript:|onerror=|onload=';.
Inspect HTTP access logs for 404 responses where the request URI contains characters such as <, >, ", or known XSS payload signatures.
Monitor WordPress audit logs for administrator account creation or role changes that correlate with admin views of admin.php?page=metaseo_broken_link.

Monitoring Recommendations

Deploy a Web Application Firewall (WAF) rule to flag or block requests whose URI contains HTML or script syntax targeting WordPress sites.
Enable verbose logging of WordPress admin page access and correlate with database write events on the wp_wpms_links table.
Schedule recurring integrity checks on WordPress user roles and capabilities to detect unauthorized privilege changes.

How to Mitigate CVE-2026-9643

Immediate Actions Required

Update the WP Meta SEO plugin to a version newer than 4.5.18 once a patched release is available from the vendor.
Until a patch is applied, deactivate the WP Meta SEO plugin or disable the 404 & Redirects feature to stop new malicious entries from being stored.
Purge existing malicious records from the wp_wpms_links table after auditing for stored payloads.
Force a password reset for all administrator accounts and review user lists for unauthorized accounts.

Patch Information

Review the WordPress plugin changelog and the Wordfence vulnerability report for the latest fix status and version guidance. Apply vendor updates through the WordPress plugin management interface as soon as a remediated release is published.

Workarounds

Implement a WAF rule blocking inbound HTTP requests that contain HTML or script syntax in the URI path or query string.
Restrict access to /wp-admin/admin.php?page=metaseo_broken_link by IP allowlist until the plugin is updated.
Apply a temporary code modification calling esc_url_raw() or sanitize_text_field() on $_SERVER['REQUEST_URI'] before it is passed to $wpdb->insert().

bash

# Example WAF rule (ModSecurity) to block script syntax in 404-bound URIs
SecRule REQUEST_URI "@rx (?i)(<script|javascript:|onerror=|onload=|<svg|<img[^>]+src=)" \
    "id:1009643,phase:1,deny,status:403,log,msg:'CVE-2026-9643 WP Meta SEO XSS attempt blocked'"