Advisories · Technology
jtsternberg CMB2.
Every CVE that names jtsternberg CMB2 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.4 Medium
CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form
- jtsternberg CMB2
- Cross-site scripting (XSS)
- CVSS 7.2 High
CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field
- jtsternberg CMB2
- Cross-site scripting (XSS)
- CVSS 7.2 High
CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type
- jtsternberg CMB2
- Cross-site scripting (XSS)
- CVSS 7.5 High
CMB2 <= 2.10.1 - Authenticated (Contributor+) PHP Object Injection
- jtsternberg CMB2
- Insecure deserialization