CVE-2026-97270 in CMB2 Plugin
Summary
by MITRE • 09/30/2026
Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as Subscriber Cross-Site Scripting within the CMB2 plugin, affecting versions up to and including 2.13.0, represents a significant security flaw rooted in insufficient input validation and output encoding mechanisms. This issue specifically targets users with subscriber-level privileges or lower, allowing them to inject malicious scripts into web pages viewed by other users. The core technical failure lies in the handling of user-supplied data within custom meta boxes created via CMB2 fields that do not properly sanitize inputs before rendering them on the frontend or backend interfaces where they are displayed without adequate escaping. This lack of proper sanitization enables an attacker to execute arbitrary JavaScript code in the context of a victim's browser session, bypassing standard security controls such as the Same-Origin Policy which normally restricts how documents loaded from one origin interact with resources from another origin.
From a technical perspective, this vulnerability is classified under CWE-79, known as Improper Neutralization of Input During Web Page Generation commonly referred to as Cross-Site Scripting. The flaw typically manifests when specific CMB2 field types accept raw HTML or script tags without filtering them through established sanitization functions like wp_kses_post or similar WordPress-specific escaping mechanisms. When a malicious actor submits crafted input containing JavaScript payloads, the application stores this data in the database and subsequently renders it directly into the DOM structure of subsequent page loads. This behavior creates an execution environment where client-side scripts can run with the privileges associated with the user viewing the compromised content rather than the attacker who injected it.
The operational impact of this vulnerability is substantial due to its potential for account takeover, session hijacking, and data exfiltration. An attacker leveraging this flaw can steal administrative cookies or authentication tokens if a privileged user views the maliciously crafted page, thereby gaining unauthorized access to sensitive areas of the WordPress installation. Furthermore, the script injection can be used to deface websites, redirect users to phishing sites designed to harvest credentials, or perform actions on behalf of the victim without their knowledge such as changing site settings deleting posts or installing further malware plugins. Since CMB2 is widely used for creating custom post types and meta boxes in many WordPress themes and plugins, the attack surface is broad affecting numerous installations that rely heavily on this library for data management interfaces.
Mitigation strategies must focus on immediate remediation through software updates and rigorous code review practices. The primary recommendation is to upgrade CMB2 to version 2.13.1 or later where these input validation issues have been addressed by the developers. For sites unable to update immediately, administrators should implement strict content security policies that restrict script execution sources and disable inline scripts using nonces to prevent unauthorized modifications. Additionally, developers integrating CMB2 into custom themes or plugins must ensure that all user inputs are sanitized upon entry using appropriate WordPress sanitization functions and escaped upon output using corresponding escaping functions such as esc_html or wp_kses_post depending on the context. Regular security audits focusing on data flow from input sources to display outputs will help identify similar vulnerabilities in other parts of the application stack ensuring a more resilient defense against cross-site scripting attacks aligned with OWASP Top Ten guidelines for web application security.