Display post meta, term meta, comment meta, and user meta

Display post meta, term meta, comment meta, and user meta has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Display post meta, term meta, comment meta, and user meta has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2023.

All of these findings were reported by Francesco Carlucci. Display post meta, term meta, comment meta, and user meta is installed on roughly 80 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.0.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all Display post meta, term meta, comment meta, and user meta vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2023-1661

Display post meta, term meta, comment meta, and user meta <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Display post meta, term meta, comment meta, and user meta banner
Latestv1.0.0

Display post meta, term meta, comment meta, and user meta

Manuel Canga

Author

Manuel Canga

0.0(0)
0/100
Last Updated
2024-11-16 (2y ago)
Active Installs
80+
Downloads
3,157
Requires WP
4.9.0+
Requires PHP
8.1+
Tested up to
WP 6.7.0
Created
2020-12-21 (6y ago)

Displays metadata in a metabox on the creation/editing pages for posts (any CPT), terms (any taxonomy), and users. The metadata is shown in a human-readable format, organized and unserialized. This metabox will only be visible to administrator users or users with the display_metadata_metabox capability. As a developer, you often need to access and review the values of metadata (or properties) attached to posts, terms, users, or comments. Whether it’s for debugging or optimizing custom functionalities, having a clear view of this data is essential for ensuring your code interacts correctly with the underlying WordPress objects. As a sysadmin, managing and cleaning up unnecessary meta fields is crucial for keeping the database lean and efficient. By understanding which meta fields are currently in use across posts, terms, comments, and users, you can make informed decisions about which metadata to remove, optimizing performance and preventing clutter in your system. As a plugin author, it’s important to verify that your plugin is creating and managing meta fields properly. The Display Meta plugin allows you to inspect whether your plugin is adding the correct metadata and helps ensure compatibility with other plugins that may also modify metadata. As a theme author, knowing which meta fields are available is key to leveraging them effectively in your theme designs. Whether you want to display custom fields in a template or use metadata for styling purposes, having direct access to this information will enable you to create more dynamic and responsive themes. In all of these cases (and many more), the Display Meta plugin simplifies the process by displaying all relevant metadata in a human-readable format, right within the WordPress admin interface. With this tool, you can easily view, organize, and manage metadata without having to dig through the database or write custom queries. Thanks Codection for reviewing this plugin. Send me bugs or improvements If you’re interested in contributing to Display Metadata, head to the Display Metadata GitHub Repository.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C