Is CVE-2026-102772 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102772 being exploited in the wild.

How severe is CVE-2026-102772?

High severity, with a CVSS score of 7.2, published 2 October 2026.

Which products and versions are affected?

CMB2 up to and including 2.13.1.

Is there a fix for CVE-2026-102772?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-102772 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-102772?

Check whether you run CMB2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102772: CMB2 for WordPress stored cross-site scripting in textarea_code field

CVE-2026-102772 · Severity: high · CVSS 7.2 · Published 2026-10-02

CMB2 is a popular WordPress plugin that manages custom form fields in post editing interfaces and front-end forms. An attacker can inject malicious scripts into textarea_code fields through public forms, which execute when any user views the affected page. Because the form save action only requires a nonce that is visible to all visitors, even unauthenticated attackers can perform this attack without needing an account.

Technologies: CMB2. Vendors: CMB2.

Quick answers

Is CVE-2026-102772 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102772 being exploited in the wild.
How severe is CVE-2026-102772?: High severity, with a CVSS score of 7.2, published 2 October 2026.
Which products and versions are affected?: CMB2 up to and including 2.13.1.
Is there a fix for CVE-2026-102772?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-102772 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-102772?: Check whether you run CMB2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the textarea_code field type, caused by insufficient input sanitization and output escaping in the CMB2_Field_Display.php and CMB2_Hookup.php components. An unauthenticated attacker can inject arbitrary JavaScript through publicly exposed CMB2 forms by exploiting the front-end save path, which only validates a publicly disclosed CMB2 box nonce via GET request. The injected script persists in the database and executes in the context of any user's session when the page is accessed.

Affected products

CMB2 CMB2 up to and including 2.13.1

Timeline

2026-10-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.