CMB2 CVE-2026-116761

Exploitable ONLY where a site integrator uses CMB2's documented front-end form helper to render a wysiwyg field inside a repeatable group on a publicly accessible page that accepts unauthenticated submissions. This is a non-default, developer-chosen configuration - standard admin-only metabox usage, non-group wysiwyg fields, and the wp-admin editor are not affected. Limiting factors: the specific grouped-wysiwyg-on-public-form deployment must exist, and a victim must subsequently view the injected page for the stored script to fire; sites not using the front-end form helper are not exposed.

This is a medium-severity stored XSS (CVSS 5.4, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) whose real-world risk is substantially lower than a network/unauthenticated vector alone would suggest. The signals are internally consistent rather than conflicting: AC:H reflects that exploitation depends on a specific condition outside the attacker's control, and the description makes that condition concrete - the flaw is 'only exploitable when a site integrator renders the plugin's documented front-end form helper with a wysiwyg field inside a repeatable group on a publicly accessible page.' PR:N is justified because such a front-end form accepts unauthenticated submissions, but the gating configuration is non-default and developer-specific, so the exposed population is a small subset of CMB2 installs. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit was identified; the vuln.today decision label is this_month (not act_now or emergency). Taken together these point to a genuine but non-urgent, configuration-dependent issue rather than a widespread, high-priority emergency - prioritize patching on sites known to use the front-end form helper with grouped wysiwyg fields, and verify whether that pattern is present before treating it as critical.

A developer has published a public page that uses CMB2's documented front-end form helper containing a repeatable group with a wysiwyg field. An unauthenticated attacker submits the form with a crafted script payload in that wysiwyg field, and because the grouped wysiwyg value is not properly sanitized/escaped, the script is stored and later executes in the browser of any user who views the injected page. No public exploit code was identified at time of analysis; the AC:H vector reflects the non-default configuration prerequisite.