CVE-2026-97336: CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type

Q: Which deployments are actually exposed to this issue?

Exposure requires an integrating plugin or theme to register a file_list field on a publicly accessible front-end form or in a user meta box. CMB2 alone does not expose these fields by default because it is a developer library.

Q: What does an attacker need to exploit it?

An attacker does not need authentication, but must be able to submit content to an exposed file_list field. The injected script executes when another user accesses the affected page.

Q: How can I determine whether my site is affected?

Review plugins and themes that use CMB2 for registered file_list fields, especially fields available through public front-end forms or user meta boxes. Sites without such exposed integrations are not exploitable through the described condition.

Published Oct 2, 2026

Updated

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filelist' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an integrating plugin or theme registers a filelist field on a publicly accessible front-end form or a user meta box, as CMB2 is a developer library and does not expose these fields by default.

Affected Software

1 affected component

CMB2 CMB2<=2.13.0

Event History

Oct 2, 2026

CVE Published

via MITRE·07:39 AM

Data Sourced

via MITRE·07:39 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are actually exposed to this issue?

Exposure requires an integrating plugin or theme to register a file_list field on a publicly accessible front-end form or in a user meta box. CMB2 alone does not expose these fields by default because it is a developer library.

What does an attacker need to exploit it?

An attacker does not need authentication, but must be able to submit content to an exposed file_list field. The injected script executes when another user accesses the affected page.

How can I determine whether my site is affected?

Review plugins and themes that use CMB2 for registered file_list fields, especially fields available through public front-end forms or user meta boxes. Sites without such exposed integrations are not exploitable through the described condition.

CVE-2026-97336: CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type

Affected Software

Event History

Frequently Asked Questions

Which deployments are actually exposed to this issue?

What does an attacker need to exploit it?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are actually exposed to this issue?

What does an attacker need to exploit it?

How can I determine whether my site is affected?