Vulnerabilities

TI-2026-81759 CVE-2026-116761 · GHSA-rfx8-wq2m-j436

Stored cross-site scripting in CMB2 WordPress plugin fields

LOW 24

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1_grp[0][txt] (wysiwyg field inside group — field id controlled by integrator config)' parameter in all versions up to, and inclu…

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00221 Published 2026-10-28 No fix listed CWE-79

TI-2026-66010 CVE-2026-102772 · GHSA-3cr2-3237-fc84

CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field

LOW 31

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<textarea_code field id> (e.g.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00307 Published 2026-10-02 No fix listed CWE-79

TI-2026-65993 CVE-2026-97336 · GHSA-c4g5-wq6m-xp45

CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type

LOW 31

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00285 Published 2026-10-02 No fix listed CWE-79

TI-2024-12915 CVE-2024-13895 · GHSA-4q5p-m3hx-89cr

Code Snippets CPT <= 2.1.0 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

LOW 28

The The Code Snippets CPT plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.1.0.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00288 Published 2025-03-08 No fix listed CWE-94

TI-2024-01668 CVE-2024-1792 · GHSA-fq8c-827p-q5gh

CMB2 <= 2.10.1 - Authenticated (Contributor+) PHP Object Injection

LOW 36

The CMB2 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.10.1 via deserialization of untrusted input from the text_datetime_timestamp_timezone field.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00822 Published 2024-04-09 No fix listed CWE-502