CVE-2026-97270

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Type in all versions up to and including 2.13.0 due to insufficient input sanitization and output escaping. This is only exploitable when an integrating plugin or theme registers a file_list field on a publicly accessible front-end form or user meta box.

The CMB2 plugin for WordPress in versions up to and including 2.13.1 is vulnerable to stored cross-site scripting (XSS) via the '<textarea_code field id>' parameter (e.g., kl_code, kl_post_code) due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. The front-end save path requires only a CMB2 box nonce, which is emitted to all visitors including unauthenticated guests via a simple GET request, making the attack trivially reachable without credentials on sites exposing a public CMB2 form writing a textarea_code field.