Vulnerabilities and security researches forcmb2 cmb2

Oct 29, 2026

CVE, Research URL: CVE-2026-116761
Home page URL: Security reports for CMB2
Application: CMB2
Date: Oct 28, 2026
Research Description: The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1_grp[0][txt] (wysiwyg field inside group — field id controlled by integrator config)' parameter in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when a site integrator renders the plugin's documented front-end form helper with a wysiwyg field inside a repeatable group on a publicly accessible page.
Affected versions: max 2.13.5.
Status: vulnerable

Oct 05, 2026

CVE, Research URL: CVE-2026-97336
Home page URL: Security reports for CMB2
Application: CMB2
Date: Oct 02, 2026
Research Description: The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an integrating plugin or theme registers a file_list field on a publicly accessible front-end form or a user meta box, as CMB2 is a developer library and does not expose these fields by default.
Affected versions: max 2.13.1.
Status: vulnerable

CVE, Research URL: CVE-2026-102772
Home page URL: Security reports for CMB2
Application: CMB2
Date: Oct 02, 2026
Research Description: The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<textarea_code field id> (e.g. kl_code, kl_post_code)' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The front-end save path requires only a CMB2 box nonce, which is emitted to all visitors including unauthenticated guests via a simple GET request, making the attack trivially reachable without any credentials on sites that expose a public CMB2 form writing a textarea_code field.
Affected versions: max 2.13.2.
Status: vulnerable

CVE, Research URL: CVE-2026-97270
Home page URL: Security reports for CMB2
Application: CMB2
Date: Sep 30, 2026
Research Description: Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.
Affected versions: max 2.13.1.
Status: vulnerable

Sep 26, 2026

CVE, Research URL: CVE-2026-80338
Home page URL: Security reports for CMB2
Application: CMB2
Date: Sep 24, 2026
Research Description: The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation requires the site's or another CMB2 WordPress plugin before 2.13.0 to have declared an oEmbed field, as the CMB2 WordPress plugin before 2.13.0 registers none of its own. The stored value is never attacker-controlled, so the issue does not lead to privilege escalation.
Affected versions: max 2.13.0.
Status: vulnerable

Jun 07, 2024

CVE, Research URL: CVE-2024-1792
Home page URL: Security reports for CMB2
Application: CMB2
Date: Apr 10, 2024
Research Description: The CMB2 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.10.1 via deserialization of untrusted input from the text_datetime_timestamp_timezone field. This makes it possible for authenticated attackers, with contributor access or higher, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Please note that the plugin is a developer toolkit. For the vulnerability to become exploitable, the presence of a metabox activation in your code (via functions.php for example) is required.
Affected versions: max 2.11.0.
Status: vulnerable