CMB2 EUVD-2026-91241

Exploitation requires that an integrating plugin or theme has registered a CMB2 'file_list' field type on either a publicly accessible front-end form or a user meta box - CMB2 ships no such exposed field by default, so a stock installation using CMB2 only for admin meta boxes is not vulnerable. Given this, the attacker needs no authentication (PR:N) and no privileged access, but the vulnerable front-end surface must already exist. Delivery is through that form's file_list input, which lacks sufficient sanitization/output escaping. The practical limiting factors are: (1) presence of a non-default front-end file_list field, and (2) a victim subsequently viewing the injected page for the stored script to fire.

This is a high-CVSS (7.2) stored XSS whose real-world risk is substantially lower than the raw score suggests, because the critical exploitation precondition is non-default. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) describes an unauthenticated, network-reachable, low-complexity attack with scope change - which on its face reads as a priority. However, the description explicitly states CMB2 is a developer library that does NOT expose file_list fields by default; exploitation requires a third-party integrating plugin or theme to register a file_list field on a publicly accessible front-end form or a user meta box. This dependency conflicts with the CVSS AC:L rating - the attack is only low-complexity in environments that already satisfy an uncommon configuration, so AC:H is more defensible (see assessed vector). No EPSS score, KEV listing, or POC is provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a legitimately exploitable stored XSS in a widely-distributed library, but realized risk is gated by whether downstream developers expose the vulnerable field on the front end - most default WordPress installs using CMB2 for admin-only meta boxes are not exposed.

A site runs a theme or plugin that uses CMB2 to render a file_list field on a public front-end submission form (e.g. a user profile or listing form). An unauthenticated attacker submits crafted input through that form that bypasses CMB2's insufficient sanitization and is stored, so when an administrator or visitor later views the page the injected script executes in their browser. No public proof-of-concept is identified in the provided data.