The CMB2 plugin for WordPress is vulnerable to Stored Cross‑Site Scripting because the WYSIWYG field inside a repeatable group is not properly sanitized or escaped. An attacker can inject malicious JavaScript into the parameter that controls the field ID, causing the script to execute for any user who views a page that renders the injected content. This type of persistence does not require user authentication to post the payload but can compromise confidentiality and integrity of the site by enabling credential theft, defacement, or injection of malware into the browsing session.

All WordPress sites using the CMB2 plugin version 2.13.4 or earlier are affected. The vulnerability applies when a site integrator renders the plugin’s documented front‑end form helper with a WYSIWYG field inside a repeatable group on a publicly accessible page. The specific product is the jtsternberg CMB2 plugin, and any public site that includes such a form is at risk.

The CVSS score is 5.4, indicating a moderate severity. No EPSS information is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that it has not yet been widely exploited in the wild. However, because the attack vector involves unauthenticated submission of user‑controlled data into a publicly exposed form, the exploitation likelihood remains realistic in environments that expose such forms. If the injected script runs, it can compromise all visitors to the affected pages.