CVE-2026-97336

Name of the Vulnerable Software and Affected Versions CMB2 versions prior to 2.13.1

Description The CMB2 plugin for WordPress contains a Stored Cross-Site Scripting issue due to insufficient input sanitization and output escaping within the file list field type. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user accesses the affected page. This issue is only exploitable if an integrating plugin or theme registers a file list field on a user meta box or a publicly accessible front-end form, as the library does not expose these fields by default.

Recommendations Update to a version newer than 2.13.0. As a temporary mitigation, restrict the use of the file list field type on publicly accessible front-end forms or user meta boxes.