CVE-2026-88997
JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of a higher-privileged user who reviews the affected post.
| Vendor | unknown |
| Product | jsm show post metadata |
| Published | Sep 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown jsm show post metadata
Be the first to know when new unknown vulnerabilities affecting unknown jsm show post metadata are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / JSM Show Post Metadata
0 < 4.9.1
References
Credits
pervinzahidli WPScan