Post Meta

Post Meta has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).

The one issue recorded for Post Meta has a vendor fix available, so running the current release closes it.

All of these findings were reported by João Pedro Soares de Alcântara. Post Meta is installed on roughly 90 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.

Strategic Overview

Avg CVSSMedium

6.1/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Post Meta vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.1CVE-2025-24549

Post Meta <= 1.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records


2025-01-16 00:00	Post Meta <= 1.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting Post Meta <= 1.0.9	`CVE-2025-24549`	6.1 Medium	João Pedro Soares de Alcântara	Yes

Showing 1–1 of 1 reports

Latestv1.1.0

Post Meta

Author

Mahbubur Rahman

3.9(7)

78/100

Last Updated

2025-01-20 (2y ago)

Active Installs

90+

Downloads

18,579

Requires WP

6.6+

Requires PHP

7.4+

Tested up to

WP 6.7.7

Created

2012-09-12 (14y ago)

Plugin Homepage | Documentation | Video Tutorial | Screenshots Post Meta is a WordPress custom post field, post type and taxonomy management Plugin. It has smart and modern (ajax and jquery based) interface to create post meta option or custom meta field as group or field. It also support smart shortcode with ui and Impot & export feature. Every developer should have it. Features Fully jQuery and ajax based Management Custom post Group and Field Duplicate Field or Group supported Sorting group and field by dragging Preview image field with thumbnail size Audio preview with player Video preview with video player Smart shortcode supported with GUI Import & export Managing Custom Post type Managing Custom Taxonomy Custom availble field list Text Box Email Website / Url Phone Number Paragraph / Text area Wp Editor Date / Time Drop Down Check box Select One (Radio) Hidden Field Image Media Image Upload Audio Upload Video Upload File Upload Shortcode with GUI Shortcode Functions get_label(), get_field(), get_duplicate_field(), get_group(), get_duplicate_group(), get_field_tpl(), get_duplicate_field_tpl(), get_group_tpl(), get_duplicate_group_tpl(),get_image(),get_audio(), get_video(), preview() For Function details Upcoming Features: Will add more custom field …and any suggestions that we may receive… Please Vote and Enjoy Your votes really make a difference! Thanks. NB Duplicate Group, Uploaded field, Shortcode and Impoer & Expoert are only supported in pro version. Get it Now

View on WordPress.org