Skip to content
Threat Feed
Subscribe

Product

CMB2 (<= 2.13.0)

1 brief RSS
high advisory

Stored Cross-Site Scripting in CMB2 WordPress Plugin

The CMB2 plugin for WordPress (<= 2.13.0) is vulnerable to Stored XSS via the file_list field type, allowing unauthenticated attackers to inject malicious scripts into public-facing forms or user meta boxes.

CMB2 web-application wordpress xss
1t 1c