The CMB2 plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the '<textarea_code field id>' parameter (e.g., kl_code, kl_post_code) is not properly sanitized or escaped in all versions up to and including 2.13.1. This allows unauthenticated attackers to inject arbitrary JavaScript that executes when users access the affected pages. The front-end save mechanism requires only a CMB2 box nonce, which is exposed to all visitors including unauthenticated guests via a simple GET request, making exploitation trivial on sites with a public CMB2 form containing a textarea_code field.

An attacker can inject persistent malicious scripts into pages that will execute in the context of any user visiting those pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires no authentication and has a low attack complexity, increasing the risk of exploitation. The CVSS 3.1 base score is 7.2 (high), reflecting network attack vector, no privileges required, no user interaction, and partial confidentiality and integrity impact with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should avoid exposing public CMB2 forms with textarea_code fields or implement additional input validation and output escaping controls. Monitoring for suspicious activity related to CMB2 forms is recommended. Since no official fix or patch link is provided, closely follow jtsternberg's advisories for updates.