CyberSecBulletin

Meta Box vulnerabilities

We track 2 vulnerabilities in Meta Box products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 22, 2026.

2vulnerabilities
2critical
0high
0exploited
9.4average CVSS score

Latest Meta Box vulnerabilities

  • 9.8 Critical severity

    Meta Box Frontend Submission: Improper Privilege Management

    CVE-2026-13355Meta Box

    The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populate_via_query_string() function in the mb-frontend-submission component unconditional

  • 9.1 Critical severity

    Meta Box AIO: Missing Authorization

    CVE-2026-14488Meta Box

    The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handle_request() function routing the mbfs_del