CVE-2026-9643 describes an unauthenticated stored cross-site scripting vulnerability in the WP Meta SEO plugin for WordPress, affecting all versions up to and including 4.5.18. The vulnerability arises in the `wpmsTemplateRedirect()` hook, which on detecting a 404 error concatenates the HTTP_HOST and raw REQUEST_URI server variables and inserts this combined value directly into the `wp_wpms_links.link_url` database column without sanitization. This allows an attacker to inject arbitrary scripts that execute in the context of an administrator's browser when they access the plugin's 404 & Redirects admin page (`/wp-admin/admin.php?page=metaseo_broken_link`). The CVSS 3.1 base score is 7.2, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity with scope change.

An unauthenticated attacker can inject malicious scripts into the plugin's database via crafted URLs, which execute in the administrator's browser when viewing the affected admin page. This can lead to theft of sensitive information, session hijacking, or other actions performed with administrator privileges. The vulnerability affects confidentiality and integrity but does not impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid accessing the 404 & Redirects admin page or restrict access to trusted users only. Monitoring for suspicious entries in the `wp_wpms_links.link_url` database column may help detect exploitation attempts.