Meta Box – A Framework for Dynamic Websites

Meta Box – A Framework for Dynamic Websites has 8 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2026; all 8 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 4 high. 2026 was the busiest year with 3 disclosures.

The most common weakness is Missing Authorization, behind 2 of the records (25%). Other recurring categories include Path Traversal, Authorization Bypass Through User-Controlled Key.

Every one of the 8 issues recorded for Meta Box – A Framework for Dynamic Websites has a vendor fix available, so running the current release closes all known holes.

6 independent researchers contributed these findings, one record each. Meta Box – A Framework for Dynamic Websites is installed on roughly 500,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
6.3/ 10
Patch Coverage100%
Open

0

Fixed

8

Get automatic notifications for all Meta Box – A Framework for Dynamic Websites vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.1CVE-2026-39468

Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion

Read the full analysis

Vulnerability Records

8 records
Meta Box – A Framework for Dynamic Websites banner
Latestv5.15.0

Meta Box – A Framework for Dynamic Websites

Meta Box

Author

Meta Box

4.8(165)
96/100
Last Updated
2026-09-03 (10d ago)
Active Installs
500,000+
Downloads
24,715,914
Requires WP
6.7+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2011-11-07 (15y ago)

You want to add events, team members, testimonials, or listings to your WordPress site. But the standard editor only handles posts and pages. You need something more, but you don’t want to overcomplicate things or slow down your site. Meta Box gives you everything you need to build dynamic WordPress sites – with over 40+ field types for adding custom fields to posts, pages, custom post types, taxonomies, settings pages, users, and comments. It’s lightweight (no bloat), flexible (works with any theme or plugin), and fast (uses native WordPress storage). No lock-in, no extra baggage. Any type of custom fields, anywhere Add custom fields to any part of WordPress: Posts & Pages – Add extra fields to regular content Custom post types – Use with our free CPT UI plugin to create custom post types and taxonomies Taxonomies – Categories, tags, and custom taxonomies via MB Term Meta Settings pages – Theme/plugin options via MB Settings Page Users – Profile fields via MB User Meta Comments – Comment fields via MB Comment Meta 40+ field types (and you can add your own) Meta Box ships with 40+ built-in field types: text, textarea, WYSIWYG, image, file upload, post select, checkbox, radio, date/time picker, taxonomy, user, oEmbed, and more. You can also create custom field types. Most fields support cloning and repeatable groups. Developer-friendly by design Lightweight API – Won’t bloat your site Modular – Add only what you need Native storage – Uses WordPress meta tables by default for speed and compatibility, and can be extended to custom tables for advanced setups Composer support – Integrates with modern PHP workflows Hooks – Extensive actions and filters for customization Integration-ready – Works with any theme or plugin Get more with Meta Box Meta Box Lite is the UI version of Meta Box that helps you manage everything visually – custom fields, post types, taxonomies, and more – without touching code. Meta Box AIO is an all-in-one plugin that bundles all free and premium extensions, giving you everything from conditional logic to frontend submissions, custom tables to Gutenberg blocks – all in one package. Documentation Full documentation and tutorials are available to get you started: Introduction Custom post types Custom fields Field settings Displaying fields You might also like If you like this plugin, you might also like our other WordPress products: Slim SEO – A fast, lightweight and full-featured SEO plugin for WordPress with minimal configuration. Falcon – A lightweight companion for making WordPress faster, cleaner, and more secure. GretaThemes – Free and premium WordPress themes that clean, simple and just work. Auto Listings – A car sale and dealership plugin for WordPress. External services This plugin may connect to third-party services when you use certain features. No data is sent until those features are used. Google Maps The map field uses the Google Maps JavaScript API to show maps and look up addresses. When a map field is displayed in the admin or on the frontend, the browser loads the Google Maps script. Address searches and map coordinates are sent to Google. You must supply your own Google Maps API key. This service is provided by Google: terms of use, privacy policy. OpenStreetMap The OSM field uses OpenStreetMap tiles to show maps and Nominatim to look up addresses. When an OSM field is displayed, the browser requests map tiles from OpenStreetMap. Address searches are sent to Nominatim. This service is provided by the OpenStreetMap Foundation: terms of use, privacy policy. Nominatim usage is also covered by the Nominatim usage policy.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C