CVE-2026-102772

The CMB2 plugin for WordPress in versions up to and including 2.13.1 is vulnerable to stored cross-site scripting (XSS) via the '<textarea_code field id>' parameter (e.g., kl_code, kl_post_code) due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. The front-end save path requires only a CMB2 box nonce, which is emitted to all visitors including unauthenticated guests via a simple GET request, making the attack trivially reachable without credentials on sites exposing a public CMB2 form writing a textarea_code field.

An attacker can execute arbitrary JavaScript in the user's browser, potentially leading to session theft, redirects, or other actions in the context of the site. This affects user confidentiality and data integrity.

Update the CMB2 plugin to a version later than 2.13.1 as soon as available. If updating is not possible, consider restricting public CMB2 forms or applying additional security measures.