Stored Cross-Site Scripting in CMB2 WordPress Plugin Due to Insufficient Input Sanitization

CVE-2026-97336

What is CVE-2026-97336?

The CMB2 plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) attacks due to inadequate input sanitization and output escaping within the 'file_list' field type. This vulnerability affects all versions of the plugin up to and including 2.13.0. It allows unauthenticated attackers to inject malicious scripts that may execute when users visit compromised pages. The risk is heightened when developers integrate this field into publicly accessible front-end forms, as CMB2 does not normally expose these fields by default.

References