CMB2 CVE-2026-102772

Exploitation requires the target site to expose a front-end (public-facing) CMB2 form that saves a textarea_code-type field (e.g. kl_code, kl_post_code); this front-end save path is reachable by anyone because it only needs the CMB2 box nonce, which is emitted to all visitors - including unauthenticated guests - via a simple GET request, so no credentials are needed once such a form exists. The key LIMITING factor is that this public textarea_code form is not CMB2's default configuration (CMB2 is predominantly used for admin-only metaboxes), so sites that only use CMB2 in wp-admin are not exposed via this unauthenticated path. Affects all versions up to and including 2.13.1. Being stored XSS, the injected script only fires when a user subsequently loads the affected page.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 High) describes a network-reachable, low-complexity, unauthenticated stored XSS with a scope change - consistent with CWE-79 affecting other users once a payload is stored. However, the real-world priority is substantially tempered by a deployment precondition: the description itself states exploitation only works 'on sites that expose a public CMB2 form writing a textarea_code field,' which is NOT CMB2's default behavior (CMB2 is primarily an admin-side metabox framework). No EPSS score, KEV listing, POC, or SSVC data was supplied in the input, so exploitation probability and automatability cannot be quantified - absence of these signals is noted but not treated as evidence of safety. Exploitation status: no public exploit identified at time of analysis. Net assessment: a legitimately exploitable unauthenticated stored XSS against affected deployments, but one whose blast radius depends heavily on a non-default front-end form configuration rather than being universally exploitable across all CMB2 installs; treat as a genuine High-priority patch for sites using public CMB2 forms, and a lower-priority hygiene fix for the typical admin-only deployment.

An attacker targets a WordPress site that publishes a public-facing CMB2 form writing a textarea_code field (e.g. kl_code), fetches the required CMB2 box nonce via a simple unauthenticated GET request, then submits a crafted request containing a JavaScript payload into that field. Because input is insufficiently sanitized and output is not escaped, the payload is stored and later executes in the browser of every user (including administrators) who views the injected page. No public exploit code is identified in the provided data, and no authentication or user interaction by the attacker is required.