CVE-2026-102772: CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<textareacode field id> (e.g. klcode, klpostcode)' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The front-end save path requires only a CMB2 box nonce, which is emitted to all visitors including unauthenticated guests via a simple GET request, making the attack trivially reachable without any credentials on sites that expose a public CMB2 form writing a textareacode field.
Affected Software
Event History
Frequently Asked Questions
Which sites are realistically exposed to unauthenticated exploitation?
Sites are exposed if they use CMB2 version 2.13.1 or earlier and publicly expose a CMB2 front-end form that writes to a textarea_code field, such as kl_code or kl_post_code. A public form is required for the described unauthenticated attack path.
Does an attacker need an account or any special interaction to exploit this?
No credentials are required where the affected public front-end form exists. The required CMB2 box nonce is emitted to unauthenticated visitors through a simple GET request, and injected script executes when someone views the affected page.
What can be done if patching cannot happen immediately?
Remove or restrict public access to CMB2 front-end forms that can save textarea_code fields. This prevents unauthenticated visitors from obtaining the nonce and submitting the described malicious content.
How can I determine whether my site may already be affected?
Review CMB2 content saved through public front-end forms for unexpected script content in textarea_code fields, including fields such as kl_code and kl_post_code. Also identify whether any publicly reachable CMB2 form writes to those fields.