CVE-2026-116761

Name of the Vulnerable Software and Affected Versions CMB2 versions prior to 2.13.5

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. This occurs via the cmb43ex1 grp[0][txt] parameter. The issue is exploitable when a site integrator uses the plugin's front-end form helper with a wysiwyg field inside a repeatable group on a publicly accessible page, allowing scripts to execute when a user visits the affected page.

Recommendations Update to version 2.13.5 or later. Restrict the use of the cmb43ex1 grp[0][txt] parameter in front-end form helpers until the update is applied.