CVE-2026-97336: CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filelist' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an integrating plugin or theme registers a filelist field on a publicly accessible front-end form or a user meta box, as CMB2 is a developer library and does not expose these fields by default.
Affected Software
Event History
Frequently Asked Questions
Which deployments are actually exposed to this issue?
Exposure requires an integrating plugin or theme to register a file_list field on a publicly accessible front-end form or in a user meta box. CMB2 alone does not expose these fields by default because it is a developer library.
What does an attacker need to exploit it?
An attacker does not need authentication, but must be able to submit content to an exposed file_list field. The injected script executes when another user accesses the affected page.
How can I determine whether my site is affected?
Review plugins and themes that use CMB2 for registered file_list fields, especially fields available through public front-end forms or user meta boxes. Sites without such exposed integrations are not exploitable through the described condition.