CVE-2026-88997
Received Received - Intake

Stored Cross-Site Scripting in JSM Show Post Metadata WordPress Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: WPScan

Description
The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of a higher-privileged user who reviews the affected post.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-88997
EUVD
EUVD-2026-85052

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
jsm_show post_metadata to 4.9.1 (exc)
jsm_show_post_metadata plugin to 4.9.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the JSM Show Post Metadata WordPress plugin before version 4.9.1. It occurs because the plugin does not properly escape a post meta key before displaying it in an inline event-handler attribute within an admin-facing meta box. This allows users with contributor-level access or higher to inject malicious JavaScript code.

Detection Guidance

Check if the JSM Show Post Metadata WordPress plugin is installed and its version. If it is below 4.9.1, the system is vulnerable. Review admin-facing meta boxes for unexpected JavaScript in post meta keys.

Impact Analysis

An attacker with contributor-level access or higher could inject JavaScript that executes when a higher-privileged user reviews the affected post. This could lead to session hijacking, unauthorized actions on behalf of the user, or theft of sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements such as GDPR or HIPAA. It could result in unauthorized data exposure or modification, potentially leading to legal and regulatory penalties.

Mitigation Strategies

Update the JSM Show Post Metadata plugin to version 4.9.1 or later immediately. Restrict contributor-level access to trusted users only. Monitor admin sessions for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88997. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart