WordPress CMB2 plugin <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Jakub Herman in WordPress Plugin CMB2 versions = 2.13.4...

CVE-2026-116761

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1grp0txt wysiwyg field inside group — field id controlled by integrator config' parameter in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-116761 CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1grp0txt wysiwyg field inside group — field id controlled by integrator config' parameter in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-116761

The CMB2 plugin for WordPress (versions up to and including 2.13.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the cmb43ex1_grp[0][txt] parameter, which corresponds to a WYSIWYG field inside a repeatable group...

CVE-2026-116761 CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1grp0txt wysiwyg field inside group — field id controlled by integrator config' parameter in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-116761 CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1grp0txt wysiwyg field inside group — field id controlled by integrator config' parameter in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. This makes ...

EUVD-2026-111602

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1grp0txt wysiwyg field inside group — field id controlled by integrator config' parameter in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-116761: jtsternberg CMB2: The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1_grp[0][txt] (wysiwyg field…

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1grp0txt wysiwyg field inside group — field id controlled by integrator config' parameter in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. This makes ...

CMB2 cross-site scripting vulnerability

CMB2 versions 2.13.4 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts via the parameter cmb43ex1grp0txt, resulting in stored cross-site scripting attacks...

PT-2026-127884

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1 grp0txt wysiwyg field inside group — field id controlled by integrator config' parameter in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-97336

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filelist' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2026-102772

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. klcode, klpostcode' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

WordPress CMB2 plugin <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin CMB2 versions = 2.13.1...

EUVD-2026-91241

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filelist' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2026-97336 CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filelist' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2026-102772 CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. klcode, klpostcode' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-102772 CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. klcode, klpostcode' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-102772

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.13.1 . The root cause is insufficient input sanitization and output escaping within the parameter (e.g., kl_code, kl_post_code). This flaw allows unauthenticated attackers to in...

CVE-2026-97336 CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filelist' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

EUVD-2026-91243

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. klcode, klpostcode' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...