Is CVE-2026-116761 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116761 being exploited in the wild.

How severe is CVE-2026-116761?

Medium severity, with a CVSS score of 5.4, published 28 October 2026.

Which products and versions are affected?

CMB2 up to and including 2.13.4.

Is there a fix for CVE-2026-116761?

Yes: fixed in 2.13.5 or later (based on patch commit dated 2026-10-26). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116761 attacked?

It is attacked over the network.

Am I affected by CVE-2026-116761?

Check whether you run CMB2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116761: CMB2 WordPress plugin stored cross-site scripting in WYSIWYG field

CVE-2026-116761 · Severity: medium · CVSS 5.4 · Published 2026-10-28

CMB2 is a plugin that adds custom content management fields to WordPress. An unauthenticated attacker can inject malicious scripts into a WYSIWYG text editor field when it is placed inside a repeatable group on a publicly accessible form, and these scripts execute when any user views the page. This vulnerability only affects sites that expose the plugin's front-end form helper with this specific field configuration.

Technologies: CMB2. Vendors: CMB2.

Quick answers

Is CVE-2026-116761 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116761 being exploited in the wild.
How severe is CVE-2026-116761?: Medium severity, with a CVSS score of 5.4, published 28 October 2026.
Which products and versions are affected?: CMB2 up to and including 2.13.4.
Is there a fix for CVE-2026-116761?: Yes: fixed in 2.13.5 or later (based on patch commit dated 2026-10-26). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116761 attacked?: It is attacked over the network.
Am I affected by CVE-2026-116761?: Check whether you run CMB2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.13.5 or later (based on patch commit dated 2026-10-26)

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the CMB2 WYSIWYG field type when used inside a repeatable group. The plugin fails to properly escape output when rendering the field's placeholder and template, allowing injected JavaScript to persist in the database. Exploitation requires a site integrator to expose the front-end form helper with a WYSIWYG field in a repeatable group on a public page, with no authentication required.

Affected products

CMB2 CMB2 up to and including 2.13.4

Timeline

2026-10-28: disclosed
2026-10-26: patched: Patch commit escapes grouped wysiwyg values in editor placeholder and template

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.