Skip to content
PluginCanary

CMB2

by Justin Sternberg · 300,000+ active installs · Checked 3 Nov 2026
Healthy5 Warnings

Healthy: vulnerability published 27 Oct 2026, fixed in 2.13.5.

82/ 100 Canary Score
Sub-scores for CMB2
Ownership100
Maintenance100
Security65
Support70
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 27 Oct 2026, fixed in 2.13.5. Update to version 2.13.5 or later.27 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 1 Oct 2026, fixed in 2.13.2. Update to version 2.13.2 or later.1 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 1 Oct 2026, fixed in 2.13.1. Update to version 2.13.1 or later.1 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 30 Sep 2026, fixed in 2.13.1. Update to version 2.13.1 or later.30 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 22 Sep 2026, fixed in 2.13.0. Update to version 2.13.0 or later.22 Sep 2026Evidence
  • InfoSEC-35 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
jtsternberg16 Sep 2014 to 27 Oct 2026, 101 commits

1 committer recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
8 days ago
Releases, 24 months
7
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for CMB2
Q1 20240
Q2 20240
Q3 20240
Q4 20240
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20260
Q2 20261
Q3 20263
Q4 20263

Last release 27 Oct 2026. Tested with WordPress 7.1 (current).

Support

Support history appears after our first snapshots of the forum counts.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
27 Oct 2026CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form5.4<= 2.13.42.13.50
1 Oct 2026CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field7.2<= 2.13.12.13.20
1 Oct 2026CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type7.2<= 2.13.02.13.10
30 Sep 2026CMB2 <= 2.13.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4<= 2.13.02.13.10
22 Sep 2026CMB2 <= 2.12.0 - Missing Authorization4.3<= 2.12.02.13.00
3 Apr 2024CMB2 <= 2.10.1 - Authenticated (Contributor+) PHP Object Injection7.5<= 2.10.12.11.0n/a

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for CMB2
Q4 20235.0
Q2 20245.0
Q2 20255.0

Average rating stayed at 5.0 between Q4 2023 and Q2 2025.

Rating distribution
5 star90
4 star0
3 star0
2 star0
1 star1

Momentum

300,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for CMB2
4 May 20261,826
11 May 20263,718
18 May 20263,707
25 May 202653,657
1 Jun 202628,404
8 Jun 202615,831
15 Jun 202613,315
22 Jun 202611,707
29 Jun 202610,747
6 Jul 202617,442
13 Jul 20269,939
20 Jul 20269,741
27 Jul 202610,060
3 Aug 20269,025
10 Aug 20267,944
17 Aug 20267,843
24 Aug 20268,353
31 Aug 20267,782
7 Sep 20266,955
14 Sep 20266,964
21 Sep 2026139,964
28 Sep 2026124,582
5 Oct 202685,308
12 Oct 202619,758
19 Oct 202618,096
26 Oct 202683,888
2 Nov 20263,418

Weekly downloads over the last 4 weeks are 17% above the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

ACF Content Analysis for Yoast SEOScore 91 · 100,000+Image Aspect Ratio Crop Field for Advanced Custom FieldsScore 91 · 20,000+Custom Post Types and Custom Fields creator - WCKScore 91 · 10,000+Genesis Custom BlocksScore 91 · 10,000+WPGraphQL for ACFScore 91 · 10,000+

Facts

Version2.13.5
AuthorJustin Sternberg
Added16 Sep 2014
Last updated27 Oct 2026
Active installs300,000+
Requires WordPress3.8.0
Tested up to7.1.4
Requires PHP7.4
CategoryDeveloper Tools & Customization > Code Snippets & Custom Code
Tagsforms, fields, options, settings, metaboxes

Other plugins by this author: Enhanced Admin Bar with Codex Search, HTML5 Slideshow Presentations, BibleGateway Links Shortcode, IFTTT Post Formats & Post Types, story|ftw, Sane Widget Sidebar Management, RefTagger Toggle

Questions

Is CMB2 still maintained?

CMB2 was last updated on 27 Oct 2026. Its Canary status is Healthy.

Is CMB2 safe?

CMB2 has no open unpatched vulnerabilities on record. 5 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns CMB2?

The wordpress.org author is Justin Sternberg. Recent committers: jtsternberg, tw2113, plugin-master. We have recorded no ownership change.

What can I use instead of CMB2?

Plugins in the same category with a higher Canary Score: ACF Content Analysis for Yoast SEO, Image Aspect Ratio Crop Field for Advanced Custom Fields, Custom Post Types and Custom Fields creator - WCK, Genesis Custom Blocks, WPGraphQL for ACF.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue