41 matches found
CVE-2026-97336
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filelist' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...
CVE-2026-102772
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. klcode, klpostcode' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
WordPress CMB2 plugin <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin CMB2 versions = 2.13.1...
CVE-2026-97336 CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filelist' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...
CVE-2026-102772
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.13.1 . The root cause is insufficient input sanitization and output escaping within the parameter (e.g., kl_code, kl_post_code). This flaw allows unauthenticated attackers to in...
CVE-2026-97336 CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filelist' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...
EUVD-2026-91241
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filelist' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...
EUVD-2026-91243
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. klcode, klpostcode' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
CVE-2026-97336
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.13.0 . The root cause is insufficient input sanitization and output escaping within the 'file_list' Field Type . This allows unauthenticated attackers to inject arbitrary web scr...
CVE-2026-102772 CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. klcode, klpostcode' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
CVE-2026-102772 CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. klcode, klpostcode' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
CVE-2026-102772: Improper Neutralization of Input During Web Page Generation
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. klcode, klpostcode' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
PT-2026-104148
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file list' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2026-97336: Improper Neutralization of Input During Web Page Generation
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filelist' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...
PT-2026-104119
Name of the Vulnerable Software and Affected Versions CMB2 versions prior to 2.13.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. By exploiting the parameter such as kl code or kl post code, an attacker can...
CVE-2026-97270
Subscriber Cross Site Scripting XSS in CMB2 = 2.13.0 versions...
CVE-2026-97270 WordPress CMB2 plugin <= 2.13.0 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in CMB2 = 2.13.0 versions...
EUVD-2026-89920
Subscriber Cross Site Scripting XSS in CMB2 = 2.13.0 versions...