# Meta Box – A Framework for Dynamic Websites

> Developer framework to create custom fields and meta boxes with code. No admin UI: for a UI, install the free Meta Box Lite.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:29 UTC.

## Facts (WordPress.org)

- Slug: `meta-box`
- Author: Meta Box
- Version: 5.15.5
- Active installs: 500,000+
- Last update: 2026-11-12 (1 day ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.7, PHP 7.4
- Tags: custom fields, custom post types, Custom Taxonomies, meta box, post type
- Page: https://wordpress.org/plugins/meta-box/

## Checks (against WordPress 7.1.4)

- OK: Updated 1 day ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Behind ↔ Current, Heavy ↔ Light, Pushy ↔ Fair, Closed ↔ Agent-ready, Leaves a mess ↔ Clean exit, Focused ↔ All-in-one (personality).

## Known vulnerabilities

- 2026-11-07 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 5.15.3). CVE-2026-123472, https://www.wordfence.com/threat-intel/vulnerabilities/id/538439d3-b801-4efe-996c-d4c1b083d192?source=api-prod
- 2026-10-29 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys (up to 5.15.2). CVE-2026-109216, https://www.wordfence.com/threat-intel/vulnerabilities/id/7a8948f5-8bcf-48f2-b3a6-bfa24ba9bef0?source=api-prod
- 2026-10-20 MEDIUM: Missing Authorization (up to 5.15.2). CVE-2026-109700, https://www.wordfence.com/threat-intel/vulnerabilities/id/5d5219cc-f23b-42da-b430-e773148299a3?source=api-prod
- 2026-08-02 MEDIUM: Authenticated (Contributor+) Insecure Direct Object Reference (before 5.13.1). CVE-2026-15248, https://www.wordfence.com/threat-intel/vulnerabilities/id/1b3610f3-d589-4a45-9f80-6b66205de093?source=api-prod
- 2026-06-15 HIGH: Authenticated (Contributor+) Arbitrary File Deletion (up to 5.11.1). CVE-2026-39468, https://www.wordfence.com/threat-intel/vulnerabilities/id/c303fffe-628b-4e88-9274-7dd242f2186e?source=api-prod
- 2026-03-06 HIGH: Authenticated (Contributor+) Arbitrary File Deletion (up to 5.11.1). CVE-2025-14675, https://www.wordfence.com/threat-intel/vulnerabilities/id/036467de-95bb-4bfd-9522-df8dc17f3102?source=api-prod
- 2024-08-09 MEDIUM: Missing Authorization to Information Exposure (up to 5.9.10). CVE-2024-43235, https://www.wordfence.com/threat-intel/vulnerabilities/id/9a49b72f-9ad9-4338-aeeb-d81be58e1c15?source=api-prod
- 2024-03-25 MEDIUM: Authenticated (Contributor+) Information Exposure via Post Meta (up to 5.9.3). CVE-2024-1204, https://www.wordfence.com/threat-intel/vulnerabilities/id/6276a405-4879-4429-8fc1-2d567ded5112?source=api-prod
- 2024-02-05 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 5.9.2). CVE-2023-6526, https://www.wordfence.com/threat-intel/vulnerabilities/id/2a6bfc87-6135-4d49-baa2-e8e6291148dc?source=api-prod
- 2019-02-02 HIGH: WordPress Custom Fields Framework <= 4.16.2 - File Deletion via attachment_id Parameter (before 4.16.3). CVE-2019-14793, https://www.wordfence.com/threat-intel/vulnerabilities/id/8341c7fb-6f3f-45ee-86c3-9c9d2617594a?source=api-prod
- 2019-02-01 HIGH: Mishandling of File Upload (up to 4.16.1). CVE-2019-14794, https://www.wordfence.com/threat-intel/vulnerabilities/id/7b5ef9de-ba5e-463e-a528-098d724b1657?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=meta-box · HTML: https://todaywp.com/plugins/meta-box