CVE-2026-102772 [HIGH] – The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ (e.g.

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ (e.g. kl_code, kl_post_code)’ parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The front-end save path requires only a CMB2 box nonce, which is emitted to all visitors including unauthenticated guests via a simple GET request, making the attack trivially reachable without any credentials on sites that expose a public CMB2 form writing a textarea_code field.</p> </div> <nav class="post-navigation"><span>上一篇<br><a href="https://www.54iter.cn/?vuln=cve-2026-102002" rel="prev">CVE-2026-102002 [LOW] – The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for Wo</a></span><span>下一篇<br><a href="https://www.54iter.cn/?vuln=cve-2026-103426" rel="next">CVE-2026-103426 [HIGH] – The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting v</a></span></nav> <section class="related-posts"> <h2>相关文章</h2> <div class="related-grid"> <a class="related-card" href="https://www.54iter.cn/?p=29989"> <span class="related-thumb"><img width="300" height="158" src="https://www.54iter.cn/wp-content/uploads/2026/09/xc-server-thermal-power-300x158.png" class="attachment-medium size-medium wp-post-image" alt="" decoding="async" loading="lazy" srcset="https://www.54iter.cn/wp-content/uploads/2026/09/xc-server-thermal-power-300x158.png 300w, https://www.54iter.cn/wp-content/uploads/2026/09/xc-server-thermal-power-1024x538.png 1024w, https://www.54iter.cn/wp-content/uploads/2026/09/xc-server-thermal-power-768x403.png 768w, https://www.54iter.cn/wp-content/uploads/2026/09/xc-server-thermal-power.png 1200w" sizes="auto, (max-width: 300px) 100vw, 300px" /></span> <span class="related-body"><b>国产服务器的散热与功耗实战</b><i>2026年9月27日</i></span> </a> <a class="related-card" href="https://www.54iter.cn/?p=29987"> <span class="related-thumb"><img width="300" height="158" src="https://www.54iter.cn/wp-content/uploads/2026/09/xc-component-compatibility-300x158.png" class="attachment-medium size-medium wp-post-image" alt="" decoding="async" loading="lazy" srcset="https://www.54iter.cn/wp-content/uploads/2026/09/xc-component-compatibility-300x158.png 300w, https://www.54iter.cn/wp-content/uploads/2026/09/xc-component-compatibility-1024x538.png 1024w, https://www.54iter.cn/wp-content/uploads/2026/09/xc-component-compatibility-768x403.png 768w, https://www.54iter.cn/wp-content/uploads/2026/09/xc-component-compatibility.png 1200w" sizes="auto, (max-width: 300px) 100vw, 300px" /></span> <span class="related-body"><b>国产内存、硬盘、网卡、RAID 卡的选型与兼容性</b><i>2026年9月27日</i></span> </a> <a class="related-card" href="https://www.54iter.cn/?p=29985"> <span class="related-thumb"><img width="300" height="158" src="https://www.54iter.cn/wp-content/uploads/2026/09/xc-team-skill-transition-300x158.png" class="attachment-medium size-medium wp-post-image" alt="" decoding="async" loading="lazy" srcset="https://www.54iter.cn/wp-content/uploads/2026/09/xc-team-skill-transition-300x158.png 300w, https://www.54iter.cn/wp-content/uploads/2026/09/xc-team-skill-transition-1024x538.png 1024w, https://www.54iter.cn/wp-content/uploads/2026/09/xc-team-skill-transition-768x403.png 768w, https://www.54iter.cn/wp-content/uploads/2026/09/xc-team-skill-transition.png 1200w" sizes="auto, (max-width: 300px) 100vw, 300px" /></span> <span class="related-body"><b>信创环境的人员技能转型</b><i>2026年9月27日</i></span> </a> <a class="related-card" href="https://www.54iter.cn/?p=29983"> <span class="related-thumb"><img width="300" height="158" src="https://www.54iter.cn/wp-content/uploads/2026/09/xc-patch-version-management-300x158.png" class="attachment-medium size-medium wp-post-image" alt="" decoding="async" loading="lazy" srcset="https://www.54iter.cn/wp-content/uploads/2026/09/xc-patch-version-management-300x158.png 300w, https://www.54iter.cn/wp-content/uploads/2026/09/xc-patch-version-management-1024x538.png 1024w, https://www.54iter.cn/wp-content/uploads/2026/09/xc-patch-version-management-768x403.png 768w, https://www.54iter.cn/wp-content/uploads/2026/09/xc-patch-version-management.png 1200w" sizes="auto, (max-width: 300px) 100vw, 300px" /></span> <span class="related-body"><b>信创环境的补丁与版本管理</b><i>2026年9月27日</i></span> </a> </div> </section> </article><aside> <section class="sidebar-section sidebar-search"><h2>搜索技术文章</h2><form role="search" method="get" class="search-form" action="https://www.54iter.cn/"> <label> <span class="screen-reader-text">搜索：</span> <input type="search" class="search-field" placeholder="搜索…" value="" name="s" /> </label> <input type="submit" class="search-submit" value="搜索" /> </form></section> <section class="sidebar-section sidebar-note"><div class="eyebrow">Focus</div><h2>本周关注</h2><p>从现象到根因，优先保留证据，再做变更。</p></section> <section class="sidebar-section"><h2>内容方向</h2><ul> <li class="cat-item cat-item-159"><a href="https://www.54iter.cn/?cat=159">AI</a> (48) <ul class='children'> <li class="cat-item cat-item-260"><a href="https://www.54iter.cn/?cat=260">AI运维</a> (12) </li> <li class="cat-item cat-item-261"><a href="https://www.54iter.cn/?cat=261">RAG应用</a> (13) </li> <li class="cat-item cat-item-259"><a href="https://www.54iter.cn/?cat=259">大模型</a> (22) </li> </ul> </li> <li class="cat-item cat-item-160"><a href="https://www.54iter.cn/?cat=160">IT动态</a> (21) </li> <li class="cat-item cat-item-156"><a href="https://www.54iter.cn/?cat=156">云原生与自动化</a> (99) <ul class='children'> <li class="cat-item cat-item-237"><a href="https://www.54iter.cn/?cat=237">CI/CD自动化</a> (10) </li> <li class="cat-item cat-item-235"><a href="https://www.54iter.cn/?cat=235">Docker容器</a> (25) </li> <li class="cat-item cat-item-234"><a href="https://www.54iter.cn/?cat=234">Kubernetes</a> (37) </li> <li class="cat-item cat-item-236"><a href="https://www.54iter.cn/?cat=236">VMware虚拟化</a> (18) </li> <li class="cat-item cat-item-239"><a href="https://www.54iter.cn/?cat=239">云原生排障</a> (17) </li> <li class="cat-item cat-item-238"><a href="https://www.54iter.cn/?cat=238">监控告警</a> (10) </li> </ul> </li> <li class="cat-item cat-item-217"><a href="https://www.54iter.cn/?cat=217">信创</a> (56) <ul class='children'> <li class="cat-item cat-item-264"><a href="https://www.54iter.cn/?cat=264">信创硬件</a> (5) </li> <li class="cat-item cat-item-265"><a href="https://www.54iter.cn/?cat=265">信创迁移</a> (14) </li> <li class="cat-item cat-item-266"><a href="https://www.54iter.cn/?cat=266">信创运维</a> (16) </li> <li class="cat-item cat-item-263"><a href="https://www.54iter.cn/?cat=263">国产操作系统</a> (10) </li> <li class="cat-item cat-item-262"><a href="https://www.54iter.cn/?cat=262">国产数据库</a> (15) </li> </ul> </li> <li class="cat-item cat-item-154"><a href="https://www.54iter.cn/?cat=154">操作系统</a> (79) <ul class='children'> <li class="cat-item cat-item-247"><a href="https://www.54iter.cn/?cat=247">Linux</a> (33) </li> <li class="cat-item cat-item-249"><a href="https://www.54iter.cn/?cat=249">Shell脚本</a> (11) </li> <li class="cat-item cat-item-248"><a href="https://www.54iter.cn/?cat=248">Windows</a> (7) </li> <li class="cat-item cat-item-250"><a href="https://www.54iter.cn/?cat=250">系统运维</a> (32) </li> </ul> </li> <li class="cat-item cat-item-1"><a href="https://www.54iter.cn/?cat=1">故障排查与实战</a> (121) <ul class='children'> <li class="cat-item cat-item-241"><a href="https://www.54iter.cn/?cat=241">存储故障</a> (22) </li> <li class="cat-item cat-item-244"><a href="https://www.54iter.cn/?cat=244">容器故障</a> (19) </li> <li class="cat-item cat-item-246"><a href="https://www.54iter.cn/?cat=246">操作系统故障</a> (27) </li> <li class="cat-item cat-item-242"><a href="https://www.54iter.cn/?cat=242">数据库故障</a> (28) </li> <li class="cat-item cat-item-240"><a href="https://www.54iter.cn/?cat=240">服务器故障</a> (26) </li> <li class="cat-item cat-item-243"><a href="https://www.54iter.cn/?cat=243">网络故障</a> (18) </li> <li class="cat-item cat-item-245"><a href="https://www.54iter.cn/?cat=245">虚拟化故障</a> (12) </li> </ul> </li> <li class="cat-item cat-item-155"><a href="https://www.54iter.cn/?cat=155">数据库</a> (83) <ul class='children'> <li class="cat-item cat-item-228"><a href="https://www.54iter.cn/?cat=228">MySQL</a> (20) </li> <li class="cat-item cat-item-229"><a href="https://www.54iter.cn/?cat=229">Oracle</a> (19) </li> <li class="cat-item cat-item-230"><a href="https://www.54iter.cn/?cat=230">PostgreSQL</a> (9) </li> <li class="cat-item cat-item-231"><a href="https://www.54iter.cn/?cat=231">Redis</a> (9) </li> <li class="cat-item cat-item-233"><a href="https://www.54iter.cn/?cat=233">数据库故障排查</a> (22) </li> <li class="cat-item cat-item-232"><a href="https://www.54iter.cn/?cat=232">数据库高可用</a> (31) </li> </ul> </li> <li class="cat-item cat-item-158"><a href="https://www.54iter.cn/?cat=158">服务器与存储</a> (62) <ul class='children'> <li class="cat-item cat-item-252"><a href="https://www.54iter.cn/?cat=252">存储设备</a> (23) </li> <li class="cat-item cat-item-253"><a href="https://www.54iter.cn/?cat=253">带外管理</a> (12) </li> <li class="cat-item cat-item-251"><a href="https://www.54iter.cn/?cat=251">服务器硬件</a> (22) </li> <li class="cat-item cat-item-254"><a href="https://www.54iter.cn/?cat=254">硬件运维</a> (26) </li> </ul> </li> <li class="cat-item cat-item-157"><a href="https://www.54iter.cn/?cat=157">网络与安全</a> (61) <ul class='children'> <li class="cat-item cat-item-258"><a href="https://www.54iter.cn/?cat=258">信创安全</a> (8) </li> <li class="cat-item cat-item-257"><a href="https://www.54iter.cn/?cat=257">等保合规</a> (11) </li> <li class="cat-item cat-item-255"><a href="https://www.54iter.cn/?cat=255">网络基础</a> (15) </li> <li class="cat-item cat-item-256"><a href="https://www.54iter.cn/?cat=256">防火墙安全</a> (15) </li> </ul> </li> </ul></section> <section class="sidebar-section"><h2>最新文章</h2><ul><li><a href="https://www.54iter.cn/?p=29989">国产服务器的散热与功耗实战</a></li><li><a href="https://www.54iter.cn/?p=29987">国产内存、硬盘、网卡、RAID 卡的选型与兼容性</a></li><li><a href="https://www.54iter.cn/?p=29985">信创环境的人员技能转型</a></li><li><a href="https://www.54iter.cn/?p=29983">信创环境的补丁与版本管理</a></li><li><a href="https://www.54iter.cn/?p=29981">信创环境的备份体系怎么建</a></li><li><a href="https://www.54iter.cn/?p=29979">信创迁移项目的组织与推进</a></li></ul></section> </aside> </div></main> <script> document.addEventListener('DOMContentLoaded',function(){ var content=document.querySelector('.article-content'); if(!content)return; var heads=content.querySelectorAll('h2,h3'); var list=document.querySelector('.toc-list'); var toc=document.querySelector('.article-toc'); if(!heads.length||!list)return; heads.forEach(function(h,i){ if(!h.id) h.id='sec-'+i; var a=document.createElement('a'); a.href='#'+h.id; a.className='toc-item'+(h.tagName==='H2'?' lv1':' lv2'); a.textContent=h.textContent; a.addEventListener('click',function(e){e.preventDefault(); var y=h.getBoundingClientRect().top+window.pageYOffset-70; window.scrollTo({top:y,behavior:'smooth'}); return false;}); list.appendChild(a); }); toc.style.display='block'; var single=document.querySelector('.article-shell'); var toggle=document.querySelector('.toc-toggle'); if(toggle&&single){ toggle.addEventListener('click',function(){ toc.classList.toggle('open'); }); } }); </script> <footer class="site-footer"> <div class="site-footer-inner"> <div><strong>机房十二时辰</strong><p>关注云计算、数据库、服务器维护与 AI 技术实践。</p></div> <div><strong>内容频道</strong><p><a href="https://www.54iter.cn/?cat=156">云计算</a> · <a href="https://www.54iter.cn/?cat=155">数据库</a> · <a href="https://www.54iter.cn/?cat=154">服务器</a> · <a href="https://www.54iter.cn/?cat=159">AI</a></p></div> <div><strong>站点导航</strong><p><a href="https://www.54iter.cn/?post_type=software">运维工具</a> · <a href="https://www.54iter.cn/">返回首页</a></p></div> </div> <div class="site-footer-bottom">© 2026 机房十二时辰 · 记录基础设施实践，整理值得关注的技术变化</div> </footer> <script id="iter-theme-js" src="https://www.54iter.cn/wp-content/themes/54iter-tech-theme/theme.js?ver=1788259993"></script> <script> var _hmt = _hmt || []; (function() { var hm = document.createElement("script"); hm.src = "https://hm.baidu.com/hm.js?f73873c4fd8ea6a65c27662bdeade87d"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(hm, s); })(); </script> </body> </html>