CMB2 EUVD-2026-89920

Requires an authenticated account with at least Subscriber privileges (PR:L), so the target site must permit that role - most impactful where open self-registration is enabled. Exploitation also requires victim user interaction (UI:R): a privileged user must view the attacker-injected content for the script to execute. Limited to CMB2 versions <= 2.13.0. The impact is confined to script execution in the victim's browser/session context (scope change to the site origin), not direct server-side code execution. The specific vulnerable CMB2 field or output sink is not identified in the available data.

This is a stored/reflected Cross-Site Scripting flaw in CMB2, scored CVSS 3.1 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The CVSS vector shows network attack vector and low attack complexity, but two factors materially constrain real-world risk: PR:L means the attacker must already hold at least a Subscriber-level authenticated account, and UI:R means a victim must interact (view the injected content) for the payload to fire. The scope change (S:C) reflects script executing in the victim's browser session against the WordPress admin/site origin, but the impact metrics are only Low across confidentiality, integrity, and availability - consistent with typical session-context XSS rather than server compromise. No EPSS score, KEV listing, POC, or SSVC data was supplied, and none of these signals indicate elevated exploitation likelihood. Net assessment: a genuine but low-to-medium priority vulnerability - patch in normal cadence. The Subscriber precondition plus required user interaction make mass, unauthenticated exploitation unlikely; this favors targeted abuse on sites that permit self-registration. The description is sparse and names no specific parameter, field, or sink, so the exact injection point cannot be confirmed from the provided data.

On a WordPress site running CMB2 <= 2.13.0 that allows open user registration, an attacker registers a low-privilege Subscriber account and submits a payload into a CMB2-rendered field that is stored and later rendered without proper output encoding. When an administrator or other user views that content, the injected JavaScript executes in their browser session (scope change), enabling session/cookie theft or actions in the victim's authenticated context. No public exploit code was identified at time of analysis.