Meta Box

Meta Box before 5.13.1 does not verify that the requester is authorized to delete the supplied attachment. A low-privilege user such as a Contributor can select media belonging to another user and permanently delete it.

Meta Box – WordPress Custom Fields Framework is affected by arbitrary file deletion. Exploitation requires an authenticated contributor account. A successful request can remove files outside the intended scope and may make the site unavailable. The published affected range is n/a through 5.11.1.

Meta Box is affected by code execution. Exploitation requires an authenticated contributor account. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

Meta Box – WordPress Custom Fields Framework is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Meta Box is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Meta Box – WordPress Custom Fields Framework is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Meta Box is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Meta Box is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.