CVE-2026-97336
Received Received - Intake

Stored XSS in CMB2 WordPress Plugin via File List Field

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: Wordfence

Description
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an integrating plugin or theme registers a file_list field on a publicly accessible front-end form or a user meta box, as CMB2 is a developer library and does not expose these fields by default.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-97336
EUVD
EUVD-2026-91241

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
webdevstudios cmb2 to 2.13.0 (inc)
cmb2 plugin to 2.13.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The CMB2 plugin for WordPress has a stored cross-site scripting vulnerability in its 'file_list' field type. This flaw allows unauthenticated attackers to inject malicious scripts into web pages. The issue arises from insufficient input sanitization and output escaping in versions up to 2.13.0.

Detection Guidance

Detection involves checking for outdated CMB2 plugin versions (up to 2.13.0) and inspecting WordPress sites for unauthorized script injections in file_list fields. Review plugin files and database entries for suspicious scripts. No direct commands are provided in the context.

Impact Analysis

This vulnerability can allow attackers to execute arbitrary web scripts on pages visited by users. If an integrating plugin or theme uses a file_list field on a public form or user meta box, attackers can inject scripts that run when users access those pages. This could lead to theft of user data or session hijacking.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, which may violate GDPR's data protection requirements or HIPAA's privacy rules. If exploited, it could result in data breaches, leading to potential fines or penalties for non-compliance with these regulations.

Mitigation Strategies

Update the CMB2 plugin to the latest version beyond 2.13.0 immediately. If updating is not possible, disable the plugin temporarily until a patch is applied. Review all forms or user meta boxes using the file_list field type for any unauthorized scripts or suspicious content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97336. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart