JSM Show Post Metadata

JSM Show Post Metadata has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 2 are fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Missing Authorization.

Every one of the 2 issues recorded for JSM Show Post Metadata has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. JSM Show Post Metadata is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium

5.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all JSM Show Post Metadata vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2026-88997

JSM Show Post Metadata <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records


2026-09-21 00:00	JSM Show Post Metadata <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting JSM Show Post Metadata <= 4.9.0	`CVE-2026-88997`	6.4 Medium	pervinzahidli	Yes
2025-01-24 00:00	JSM Show Post Metadata <= 4.6.0 - Missing Authorization JSM Show Post Metadata <= 4.6.0	`CVE-2025-24589`	4.3 Medium	Thái An	Yes

Showing 1–2 of 2 reports

Latestv4.9.1

JSM Show Post Metadata

Author

JS Morisset

5.0(12)

100/100

Last Updated

2026-10-15 (13d ago)

Active Installs

10,000+

Downloads

278,482

Requires WP

6.0+

Requires PHP

7.4.33+

Tested up to

WP 7.1.3

Created

2016-08-01 (10y ago)

The JSM Show Post Metadata plugin displays post (ie. posts, pages, and custom post types) meta keys (aka custom field names) and unserialized values in a metabox at the bottom of the post editing page. Note that if you’re using WooCommerce HPOS (High-Performance Order Storage), available since WooCommerce v8.2, then your WooCommerce orders are NOT post objects and you should use the JSM Show Order Metadata plugin instead. There are no plugin settings – simply install and activate the plugin. Available Filters for Developers Filter the post meta shown in the metabox: 'jsmspm_metabox_table_metadata' ( array $metadata, $post_obj ) Array of regular expressions to exclude meta keys: 'jsmspm_metabox_table_exclude_keys' ( array $exclude_keys, $post_obj ) Capability required to show post meta: 'jsmspm_show_metabox_capability' ( 'manage_options', $post_obj ) Show post meta for a post type (defaults to true): 'jsmspm_show_metabox_post_type' ( true, $post_type ) Capability required to delete post meta: 'jsmspm_delete_meta_capability' ( 'manage_options', $post_obj ) Icon for the delete post meta button: 'jsmspm_delete_meta_icon_class' ( 'dashicons dashicons-table-row-delete' ) Related Plugins JSM Show Comment Metadata JSM Show Order Metadata for WooCommerce HPOS JSM Show Post Metadata JSM Show Term Metadata JSM Show User Metadata JSM Show Registered Shortcodes

View on WordPress.org