Skip to content
OpenAdvisories

Vendor

jtsternberg

5 known vulnerabilities.

Products

CMB2 4 Code Snippets CPT 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.2
    CVE-2026-97336

    CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type

    The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…

    jtsternberg CMB2 Web / CMS
  • High 7.2
    CVE-2026-102772

    CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field

    The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<textarea_code field id> (e.g. kl_code, kl_post_code)' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This …

    jtsternberg CMB2 Web / CMS
  • High 7.5
    CVE-2024-1792

    CMB2 <= 2.10.1 - Authenticated (Contributor+) PHP Object Injection

    The CMB2 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.10.1 via deserialization of untrusted input from the text_datetime_timestamp_timezone field. This makes it possible for authenticated attackers, with c…

    jtsternberg CMB2 Web / CMS