CVE-2026-9643 is a stored cross-site scripting vulnerability in the WP Meta SEO WordPress plugin by joomunited. The vulnerability arises in the wpmsTemplateRedirect() hook, which on detecting a 404 error concatenates the HTTP_HOST and raw REQUEST_URI server variables and inserts this combined value directly into the wp_wpms_links.link_url database column without sanitization. This allows unauthenticated attackers to inject arbitrary scripts that execute in the context of an administrator's browser when they access the plugin's 404 & Redirects admin page (/wp-admin/admin.php?page=metaseo_broken_link). The CVSS 3.1 score is 7.2 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity with scope changed.

An unauthenticated attacker can inject persistent malicious scripts into the plugin's database via manipulated HTTP_HOST and REQUEST_URI values. These scripts execute in the administrator's browser when viewing the affected admin page, potentially leading to credential theft, session hijacking, or other actions performed with administrator privileges. The vulnerability compromises confidentiality and integrity but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid accessing the 404 & Redirects admin page or restrict access to trusted users only. Monitor official joomunited communications for updates and apply patches promptly once released.