CMB2 < 2.13.1 - Unauthenticated Stored XSS via 'file_list' Field Type

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the 'file_list' field type due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page. This is only exploitable when an integrating plugin or theme registers a file_list field on a publicly accessible front-end form or user meta box, as CMB2 is a developer library and does not expose these fields by default.