Subscriber XSS in CMB2 Plugin

Executive Summary

This is a Subscriber Cross Site Scripting (XSS) vulnerability in the CMB2 WordPress plugin versions 2.13.0 and below. It allows attackers to inject malicious scripts into websites by exploiting a flaw that requires a privileged user to perform an action like clicking a link or submitting a form.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your CMB2 plugin version is 2.13.0 or below. You can do this by inspecting the plugin files or using WordPress admin panel under Plugins. No specific commands are provided, but manual verification of the plugin version is required.

Useful 0 Not Useful 0

Impact Analysis

Attackers could steal visitor data or hijack accounts by injecting malicious scripts. The vulnerability requires a privileged user, such as a Subscriber or Developer, to trigger the attack, potentially compromising website security and user privacy.

Useful 0 Not Useful 0

Compliance Impact

This XSS vulnerability could lead to unauthorized script execution, potentially exposing user data. For GDPR, this may violate Article 32 (security of processing) if personal data is compromised. For HIPAA, it risks breaches of protected health information if exploited on healthcare-related sites. Compliance depends on the specific data processed and whether the vulnerability is exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the CMB2 plugin to version 2.13.1 or later. If updating is not possible, seek assistance from a hosting provider or web developer. Enable auto-updates for vulnerable plugins if using Patchstack.

Useful 0 Not Useful 0