CVE-2026-97270 is a CWE-79 cross-site scripting vulnerability in CMB2 versions up to and including 2.13.0. It arises from improper neutralization of input during web page generation, which could allow an attacker with low privileges and requiring user interaction to execute scripts that impact confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and scope changed, with partial impacts on confidentiality, integrity, and availability.

An attacker with subscriber-level privileges can exploit this vulnerability to execute arbitrary scripts in the context of other users, potentially leading to partial disclosure of information, modification of data, or disruption of service. The attack requires user interaction and has a medium overall impact.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting subscriber privileges where possible and educating users about phishing and suspicious links.