Meta Box – A Framework for Dynamic Websites

5.15.3 – 2026-10-20

Fix stored XSS in background field via unexpected array keys

Sanitize block editor field content on save

Fix a permission bypass in the [rwmb_meta] shortcode. The shortcode now checks whether the current user can read the object before it prints a value. Credit Mohammed Dsleman.

Public posts and terms stay readable. Password-protected posts need read_post until the visitor enters the password

User meta needs edit_user

Use rwmb_meta_shortcode_permission to override the check when needed

Only allow predefined keys to be used for block bindings (#1707)

Declare the text fields of blocks to WPML

5.15.3

Fix a permission bypass in the [rwmb_meta] shortcode. The shortcode now checks whether the current user can read the object before it prints a value.

Public posts and terms stay readable. Password-protected posts need read_post until the visitor enters the password

Settings pages, network settings pages, and models use their own capability

User meta needs edit_user

Use rwmb_meta_shortcode_permission to override the check when needed

5.15.2 – 2026-10-07

Show feature image for post field (if post type supports), and avatar for user field

5.15.1 – 2026-09-17

Fix multibyte IDs breaking WordPress 7.1 meta box tooltips

Fix focus handling for hidden validation error elements

5.15.0 – 2026-09-03
Highlights:

This version adds support for WooCommerce HPOS that allows you to use Meta Box fields to WooCommerce orders (with WooCommerce’s High-Performance