Description

The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of a higher-privileged user who reviews the affected post.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-23T06:17:04.967Z",
  "pubdate": "2026-09-23T06:17:04.967Z",
  "executiveSummary": "The JSM Show Post Metadata WordPress plugin, in versions prior to 4.9.1, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThis security flaw stems from the improper sanitization and escaping of post meta key data before it is rendered within an inline JavaScript event-handler attribute inside an admin-facing meta box.\nThe vulnerability allows an authenticated attacker with contributor-level privileges or higher to inject malicious JavaScript payloads into post metadata.\nWhen a higher-privileged user, such as an administrator or editor, views the affected post within the WordPress dashboard, the injected script executes within the context of their active session.\nSuccessful exploitation facilitates unauthorized actions, session hijacking, or administrative account compromise, posing a significant risk to the integrity and confidentiality of the WordPress installation.\nExploitation requires the attacker to have at least contributor-level access to the target WordPress site, limiting the scope of the vulnerability to authenticated users with post-creation or editing capabilities.",
  "technicalDetails": "The root cause of this vulnerability is a failure to implement output encoding or context-aware escaping on post meta keys before they are placed inside HTML event-handler attributes (e.g., onclick, onmouseover) in the administrative interface.\nIn WordPress development, post meta keys are often treated as trusted data; however, when rendered directly into a template or admin interface without rigorous output filtering, they become vectors for XSS.\nThe vulnerability occurs because the plugin dynamically generates HTML elements for the meta box interface and embeds the post meta key directly into the attribute string.\nAn attacker with contributor-level access can manipulate the post metadata by creating or editing a post and setting a specially crafted post meta key containing JavaScript event handlers or breaking the attribute string to inject arbitrary script blocks.\nThe attack flow proceeds as follows: 1) The attacker creates a new post or edits an existing post they have access to. 2) The attacker inserts a malicious payload into the meta key field, for example, using a sequence such as 'onmouseover=alert(1)'. 3) The malicious metadata is stored in the wp_postmeta database table. 4) An administrator or privileged user accesses the administrative dashboard to review or edit the attacker's post. 5) The plugin's meta box rendering logic retrieves the malicious meta key from the database and echoes it directly into the HTML source code within an inline handler. 6) The administrator's browser parses the malicious JavaScript, executing it with the privileges of the administrator session.\nBecause the payload executes in the administrative context, the attacker can perform actions that are restricted to higher-privileged accounts, such as creating new administrative users, modifying plugin settings, or exfiltrating sensitive data from the WordPress environment via client-side requests.\nThe flaw affects JSM Show Post Metadata versions prior to 4.9.1. The lack of validation and sanitization at the point of ingestion, combined with the lack of escaping at the point of output, allows the payload to persist until the specific meta box is rendered in the backend."
}