Stored Cross-Site Scripting in CMB2 Plugin for WordPress

CVE-2026-116761

What is CVE-2026-116761?

The CMB2 plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. This vulnerability occurs through the 'cmb43ex1_grp[0][txt]' parameter (a wysiwyg field) in all versions up to 2.13.4. Attackers can exploit this issue to inject arbitrary web scripts, which will execute when a user accesses a compromised page. This risk is particularly significant when a site integrator employs the plugin's front-end form helper featuring a wysiwyg field within a repeatable group on publicly accessible pages.

References