--- id: CVE-2026-102772 title: >- The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' (e.g summary: >- The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' (e.g. kl_code, kl_post_code)' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and … severity: high cvss: 7.2 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N' cwe: - CWE-79 vendor: jtsternberg product: CMB2 affected: - CMB2 <= 2.13.1 published: '2026-10-02' updated: '2026-10-02' sourceUpdated: '2026-10-02T13:18:55.613' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102772' references: - url: >- https://plugins.trac.wordpress.org/browser/cmb2/tags/2.13.1/includes/CMB2_Field_Display.php#L288 label: security@wordfence.com - url: >- https://plugins.trac.wordpress.org/browser/cmb2/tags/2.13.1/includes/CMB2_Hookup.php#L900 label: security@wordfence.com - url: >- https://plugins.trac.wordpress.org/browser/cmb2/tags/2.13.1/includes/CMB2_Sanitize.php#L464 label: security@wordfence.com - url: >- https://plugins.trac.wordpress.org/browser/cmb2/tags/2.13.1/includes/helper-functions.php#L320 label: security@wordfence.com - url: >- https://plugins.trac.wordpress.org/changeset?reponame=&old=3720258%40cmb2&new=3720258%40cmb2 label: security@wordfence.com - url: >- https://www.wordfence.com/threat-intel/vulnerabilities/id/338d824c-e99a-48c2-8844-4ca1104b5143?source=cve label: security@wordfence.com tags: - nvd - cve.org ingestedAt: '2026-10-02T08:14:06.220Z' --- ## Overview The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' (e.g. kl_code, kl_post_code)' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The front-end save path requires only a CMB2 box nonce, which is emitted to all visitors including unauthenticated guests via a simple GET request, making the attack trivially reachable without any credentials on sites that expose a public CMB2 form writing a textarea_code field. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges.