Vulnerabilities / CMB2
CMB2 vulnerabilities
Advisories WPSec published for CMB2. Other sources may list more. Its attack surface: CMB2 on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-10 | WPSEC-2026-0729 | CMB2 <= 2.13.3 - Reflected Cross-Site Scripting via Object ID Request Parameters | Medium 6.1 | 2.13.4 |
| 2026-10-10 | WPSEC-2026-0728 | CMB2 <= 2.13.3 - Unauthenticated Sensitive Information Exposure via REST API Field Endpoints | Medium 5.3 | 2.13.4 |
| 2026-10-07 | WPSEC-2026-0552 | CMB2 <= 2.13.2 - Authenticated (Editor+) Limited Options Update via REST API 'object_type' and 'object_id' Parameters | Medium 5.0 | 2.13.3 |
| 2026-10-01 | WPSEC-2026-0117 | CMB2 <= 2.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Field Display Values | Medium 6.4 | 2.13.2 |
License: CC BY 4.0