WP Meta SEO

WP Meta SEO has 18 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; 16 are fixed and 2 remain unpatched as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 6 high. 2023 was the busiest year with 10 disclosures.

The most common weakness is Missing Authorization, behind 6 of the records (33%). Other recurring categories include Cross-Site Scripting, Cross-Site Request Forgery (CSRF).

16 of the records (89%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2026.

8 independent researchers contributed these findings, most of them (7) reported by Marco Wotschka.

Strategic Overview

Avg CVSSMedium

6.0/ 10

Patch Coverage89%

Open

Fixed

Get automatic notifications for all WP Meta SEO vulnerabilities before they are exploited.

Most severe open issueCVSS 7.2CVE-2026-9643

WP Meta SEO <= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Logging

Read the full analysis

Vulnerability Records

18 records


2026-06-23 16:46	WP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter WP Meta SEO <= 4.5.18	`CVE-2026-11370`	6.4 Medium	Enes Ismaili	No
2026-06-23 16:46	WP Meta SEO <= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Logging WP Meta SEO <= 4.5.18	`CVE-2026-9643`	7.2 High	zedeq	No
2024-09-12 00:00	WP Meta SEO <= 4.5.13 - Authenticated (Administrator+) Stored Cross-Site Scripting WP Meta SEO <= 4.5.13	`CVE-2024-45455`	4.4 Medium	Robert DeVore	Yes
2024-09-12 00:00	WP Meta SEO <= 4.5.13 - Authenticated (Contributor+) Stored Cross-Site Scripting WP Meta SEO <= 4.5.13	`CVE-2024-45456`	6.4 Medium	Robert DeVore	Yes
2024-04-16 00:00	WP Meta SEO <= 4.5.12 - Unauthenticated Stored Cross-Site Scripting via Referer header WP Meta SEO <= 4.5.12	`CVE-2023-6961`	7.2 High	Krzysztof Zając	Yes
2024-04-16 00:00	WP Meta SEO <= 4.5.12 - Information Exposure via Meta Description WP Meta SEO <= 4.5.12	`CVE-2023-6962`	5.3 Medium	Krzysztof Zając	Yes
2023-03-27 00:00	WP Meta SEO <= 4.5.4 - Authenticated (Author+) PHAR Deserialization WP Meta SEO <= 4.5.4	`CVE-2023-1381`	8.8 High	Alex Sanford	Yes
2023-02-24 00:00	WP Meta SEO <= 4.5.3 - Missing Authorization in 'listPostsCategory' WP Meta SEO <= 4.5.3	`CVE-2023-1026`	4.3 Medium	Marco Wotschka	Yes
2023-02-24 00:00	WP Meta SEO <= 4.5.3 - Missing Authorization in 'saveSitemapSettings' WP Meta SEO <= 4.5.3	`CVE-2023-1023`	5.4 Medium	Marco Wotschka	Yes
2023-02-24 00:00	WP Meta SEO <= 4.5.3 - Cross-Site Request Forgery via 'regenerateSitemaps' WP Meta SEO <= 4.5.3	`CVE-2023-1029`	4.3 Medium	Marco Wotschka	Yes

Showing 1–10 of 18 reports