CVE-2026-116761

MediumCVSS 5.4

Published: 28/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Summary

The CMB2 plugin for WordPress in all versions up to and including 2.13.4 is vulnerable to stored cross-site scripting via the 'cmb43ex1_grp[0][txt]' parameter (a wysiwyg field inside a group whose field id is controlled by integrator config) due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when a user accesses an injected page; this is only exploitable when a site integrator renders the plugin's documented front-end form helper with a wysiwyg field inside a repeatable group on a publicly accessible page.

Risk Assessment

An unauthenticated attacker can execute malicious scripts in users' browsers on pages using the vulnerable form helper. This can lead to session hijacking and data theft.

Recommendation

Update the CMB2 plugin to a version later than 2.13.4 or disable it, then verify that the site does not render the vulnerable form helper with a wysiwyg field inside a repeatable group on public pages.

Other vulnerabilities in CMB2 WordPress plugin

CVE-2026-80338Medium
The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation requires the site's or another CMB2 WordPress plugin before 2.13.0 to have declared an oEmbed field, as the CMB2 WordPress plugin before 2.13.0 registers none of its own. The stored value is never attacker-controlled, so the issue does not lead to privilege escalation.

Original NVD description (English source)

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1_grp[0][txt] (wysiwyg field inside group — field id controlled by integrator config)' parameter in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when a site integrator renders the plugin's documented front-end form helper with a wysiwyg field inside a repeatable group on a publicly accessible page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS