Cmb2
Monthly
Stored cross-site scripting in the CMB2 WordPress plugin, affecting versions through 2.13.1, lets unauthenticated attackers inject arbitrary scripts into pages that expose a public front-end CMB2 form saving a textarea_code field such as kl_code or kl_post_code. The root cause is insufficient sanitization and output escaping of that field, and the front-end save path is reachable without credentials because it requires only a CMB2 box nonce that is emitted to all visitors, including guests; the injected payload then executes when a victim loads the affected page. CVSS 3.1 rates this High (7.2, AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), but real-world exposure is limited to the non-default case of public textarea_code forms, and no public exploit identified at time of analysis or CISA KEV confirmation was provided.
Stored cross-site scripting (XSS) in the CMB2 WordPress library (all versions up to and including 2.13.0) allows unauthenticated attackers to inject arbitrary web scripts via the 'file_list' field type, which execute when a user views an injected page. Exploitation requires that an integrating plugin or theme has registered a file_list field on a publicly accessible front-end form or a user meta box; CMB2 by default does not expose such fields, so a stock installation is not vulnerable. No public exploit identified at time of analysis, and the assessed CVSS vector (AC:H) reflects the non-default configuration prerequisite, making real-world risk lower than the 7.2 base score suggests.
Cross-site scripting in the CMB2 WordPress plugin affects all versions up to and including 2.13.0, allowing an attacker with only Subscriber-level access to inject script that executes inside a privileged user's browser session. Successful exploitation requires the target site to permit low-privilege accounts (most impactful where open self-registration is enabled) and requires a victim to view the injected content, matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (6.5 Medium); because the scope changes, injected script runs in the context of the site origin rather than a sandboxed component. No public exploit code or confirmed active exploitation was identified at time of analysis, and the impact is limited to browser-side script execution rather than server-side code execution.
Sites running the CMB2 WordPress plugin before 2.13.0 can have arbitrary WordPress options created or overwritten by any authenticated user holding a Subscriber-level account, because one of the plugin's AJAX actions performs no capability check; this can corrupt core site settings and render the site unusable. Exploitation is conditional: the site must have declared an oEmbed field - either through CMB2 itself or, far more commonly, through another plugin or theme built on CMB2 - since CMB2 registers no oEmbed fields of its own, and publicly available exploit code exists, though CISA SSVC records no known exploitation. The stored value is never attacker-controlled, so the impact is confined to integrity and availability (CVSS 6.8) with no confidentiality loss and no privilege escalation, and the vendor has released CMB2 2.13.0 as the fix.
Stored cross-site scripting in the CMB2 WordPress plugin, affecting versions through 2.13.1, lets unauthenticated attackers inject arbitrary scripts into pages that expose a public front-end CMB2 form saving a textarea_code field such as kl_code or kl_post_code. The root cause is insufficient sanitization and output escaping of that field, and the front-end save path is reachable without credentials because it requires only a CMB2 box nonce that is emitted to all visitors, including guests; the injected payload then executes when a victim loads the affected page. CVSS 3.1 rates this High (7.2, AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), but real-world exposure is limited to the non-default case of public textarea_code forms, and no public exploit identified at time of analysis or CISA KEV confirmation was provided.
Stored cross-site scripting (XSS) in the CMB2 WordPress library (all versions up to and including 2.13.0) allows unauthenticated attackers to inject arbitrary web scripts via the 'file_list' field type, which execute when a user views an injected page. Exploitation requires that an integrating plugin or theme has registered a file_list field on a publicly accessible front-end form or a user meta box; CMB2 by default does not expose such fields, so a stock installation is not vulnerable. No public exploit identified at time of analysis, and the assessed CVSS vector (AC:H) reflects the non-default configuration prerequisite, making real-world risk lower than the 7.2 base score suggests.
Cross-site scripting in the CMB2 WordPress plugin affects all versions up to and including 2.13.0, allowing an attacker with only Subscriber-level access to inject script that executes inside a privileged user's browser session. Successful exploitation requires the target site to permit low-privilege accounts (most impactful where open self-registration is enabled) and requires a victim to view the injected content, matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (6.5 Medium); because the scope changes, injected script runs in the context of the site origin rather than a sandboxed component. No public exploit code or confirmed active exploitation was identified at time of analysis, and the impact is limited to browser-side script execution rather than server-side code execution.
Sites running the CMB2 WordPress plugin before 2.13.0 can have arbitrary WordPress options created or overwritten by any authenticated user holding a Subscriber-level account, because one of the plugin's AJAX actions performs no capability check; this can corrupt core site settings and render the site unusable. Exploitation is conditional: the site must have declared an oEmbed field - either through CMB2 itself or, far more commonly, through another plugin or theme built on CMB2 - since CMB2 registers no oEmbed fields of its own, and publicly available exploit code exists, though CISA SSVC records no known exploitation. The stored value is never attacker-controlled, so the impact is confined to integrity and availability (CVSS 6.8) with no confidentiality loss and no privilege escalation, and the vendor has released CMB2 2.13.0 as the fix.