The CMB2 plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in the 'file_list' field type due to improper neutralization of input during web page generation. This vulnerability affects all versions from 0 up to and including 2.13.0. An unauthenticated attacker can exploit this flaw by injecting arbitrary web scripts into pages that will execute in the context of users who visit those pages. However, exploitation depends on the presence of an integrating plugin or theme that registers the vulnerable field on a publicly accessible front-end or user meta box, since CMB2 itself is a developer library and does not expose these fields by default.

Successful exploitation allows an unauthenticated attacker to perform stored cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of users visiting affected pages. This can result in information disclosure or session hijacking. The vulnerability does not affect availability and requires specific conditions to be exploitable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the 'file_list' field type on publicly accessible front-end forms or user meta boxes in plugins or themes that integrate with CMB2. Monitor vendor communications for updates on patches or official mitigations.