CVE-2026-116761 in CMB2 Plugin
Summary
by MITRE • 10/28/2026
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1_grp[0][txt] (wysiwyg field inside group — field id controlled by integrator config)' parameter in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when a site integrator renders the plugin's documented front-end form helper with a wysiwyg field inside a repeatable group on a publicly accessible page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The CMB2 plugin for WordPress, specifically versions up to and including 2.13.4, contains a critical security vulnerability classified as Stored Cross-Site Scripting (XSS). This flaw resides within the handling of the cmb43ex1_grp[0][txt] parameter, which corresponds to a WYSIWYG field nested inside a repeatable group structure. The root cause of this vulnerability is insufficient input sanitization and output escaping during the processing of form data submitted by users. Because the field identifier is controlled by integrator configuration rather than being hardcoded in a way that enforces strict validation across all implementations, the security boundary relies heavily on the correct implementation practices of the site developer or administrator integrating the plugin.
The operational impact of this vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages served by vulnerable WordPress sites. Since the flaw is classified as stored XSS, the malicious script payload is saved within the application's database rather than being executed immediately via a crafted URL parameter. Consequently, every user who accesses a page containing the injected content will have their browser execute the attacker-controlled JavaScript code. This can lead to severe consequences including session hijacking, credential theft, defacement of the website, or using the compromised site as a vector for further attacks against other users. The exploitability is contingent upon specific configuration conditions where an integrator renders the plugin's documented front-end form helper with a WYSIWYG field inside a repeatable group on a publicly accessible page.
From a technical classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves the failure to properly sanitize rich text input and escape output when rendering dynamic content derived from user submissions. In terms of adversary tactics, this flaw facilitates techniques associated with ATT&CK ID T1059, specifically Command and Scripting Interpretation via browser-based scripting languages like JavaScript. Attackers can leverage this capability to perform actions on behalf of authenticated users if session cookies are accessible or to redirect victims to phishing sites designed to harvest credentials.
Mitigation strategies must address both the immediate technical flaw and broader configuration hygiene. The primary remediation is for site administrators to upgrade the CMB2 plugin to a version that includes patches for this input validation issue, ensuring that all WYSIWYG fields within repeatable groups are properly sanitized before storage and escaped upon output rendering. For sites unable to update immediately due to compatibility constraints, temporary mitigations include disabling public access to forms containing these specific field configurations or implementing server-side web application firewall rules that detect and block common XSS payload patterns in form submissions. Additionally, developers should review integrator documentation to ensure that any custom implementations of the front-end form helper enforce strict output encoding using WordPress functions such as wp_kses_post for WYSIWYG content to neutralize malicious scripts before they reach the client browser.