Threats tagged 'ghsa-rfx8-wq2m-j436'

The CMB2 plugin for WordPress up to and including version 2.13.4 is vulnerable to a stored cross-site scripting (XSS) flaw via a wysiwyg field inside a repeatable group. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access affected pages. Exploitation requires the site integrator to render the plugin's front-end form helper with the vulnerable field on a publicly accessible page.