Plugin icon

CMB2

cmb2

Vulnerabilities:

5

Last Updated:

October 9, 2026

Active Installs:

300000

Published
Title
Fixed in
CVSS
Published
2026-10-01
Title
CMB2 < 2.13.1 - Unauthenticated Stored XSS via 'file_list' Field Type
Fixed in
Fixed in 2.13.1
CVSS
7.2 (high)
Published
2026-10-01
Title
CMB2 < 2.13.2 - Unauthenticated Stored XSS via 'textarea_code' Field
Fixed in
Fixed in 2.13.2
CVSS
7.2 (high)
Published
2026-09-30
Title
CMB2 < 2.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.13.1
CVSS
6.4 (medium)
Published
2026-09-22
Title
CMB2 < 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed Handler
Fixed in
Fixed in 2.13.0
CVSS
6.8 (medium)
Published
2024-04-03
Title
CMB2 < 2.11.0 - Authenticated (Contributor+) PHP Object Injection
Fixed in
Fixed in 2.11.0
CVSS
7.5 (high)