JSM Show Post Metadata

Explore JSM Show Post Metadata vulnerabilities across all versions. Currently tracking 1 known vulnerabilities, including severity, impact, and patch status.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all JSM Show Post Metadata vulnerabilities before they are exploited.

Vulnerability Records

1 records
Showing 1–1 of 1 reports
JSM Show Post Metadata banner
Latestv4.9.0

JSM Show Post Metadata

JS Morisset

Author

JS Morisset

5.0(12)
100/100
Last Updated
2026-07-22 (7d ago)
Active Installs
10,000+
Downloads
265,357
Requires WP
6.0+
Requires PHP
7.4.33+
Tested up to
WP 7.0.2
Created
2016-08-01 (10y ago)

The JSM Show Post Metadata plugin displays post (ie. posts, pages, and custom post types) meta keys (aka custom field names) and unserialized values in a metabox at the bottom of the post editing page. Note that if you’re using WooCommerce HPOS (High-Performance Order Storage), available since WooCommerce v8.2, then your WooCommerce orders are NOT post objects and you should use the JSM Show Order Metadata plugin instead. There are no plugin settings – simply install and activate the plugin. Available Filters for Developers Filter the post meta shown in the metabox: 'jsmspm_metabox_table_metadata' ( array $metadata, $post_obj ) Array of regular expressions to exclude meta keys: 'jsmspm_metabox_table_exclude_keys' ( array $exclude_keys, $post_obj ) Capability required to show post meta: 'jsmspm_show_metabox_capability' ( 'manage_options', $post_obj ) Show post meta for a post type (defaults to true): 'jsmspm_show_metabox_post_type' ( true, $post_type ) Capability required to delete post meta: 'jsmspm_delete_meta_capability' ( 'manage_options', $post_obj ) Icon for the delete post meta button: 'jsmspm_delete_meta_icon_class' ( 'dashicons dashicons-table-row-delete' ) Related Plugins JSM Show Comment Metadata JSM Show Order Metadata for WooCommerce HPOS JSM Show Post Metadata JSM Show Term Metadata JSM Show User Metadata JSM Show Registered Shortcodes

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C