# CVE-2026-116761 - CMB2 (WordPress) <= 2.13.4 stored XSS: a wysiwyg field inside a
# repeatable group rendered by the plugin's documented front-end form helper on a public
# page is insufficiently sanitized, letting an unauthenticated visitor store script. This
# matches a CMB2 front-end form submission (submit-cmb / object_id markers) whose body
# carries a script or HTML event-handler payload.
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-116761 WordPress CMB2 - Front-end wysiwyg Group Stored XSS"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"submit-cmb"; nocase; fast_pattern; content:"object_id"; nocase; pcre:"/(?:%3c|<)\s*(?:script|svg|img|iframe)[^>]*(?:on\w+\s*(?:%3d|=)|src\s*(?:%3d|=)|(?:%3e|>))|on(?:error|load|mouseover)\s*(?:%3d|=)/i"; classtype:web-application-attack; reference:cve,CVE-2026-116761; reference:url,https://www.exploit.observer/?keyword=CVE-2026-116761&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=wordpress&match=exact; sid:1098604; rev:1;)