CMB2 changelog and version history

20267 releases

1. CMB2 2.13.5Latest

   Oct 27, 2026
   • [Development] Fixed the PHPUnit CI legs that test against the latest WordPress: they now use the test suite tagged for the latest stable release instead of wordpress-develop trunk, which can require core APIs a stable release does not have yet.
   • Fixed multicheck and multicheck_inline fields (including inside a group) not saving when the only checked option has the value 0. Non-repeatable array values that hold only 0 or '0', such as from custom field types, are no longer treated as empty and deleted on save. Such a field now stores array(…
   • Fixed repeatable fields (including repeatable fields in a group) dropping a 0 or '0' entry on save and not showing a saved 0 row on the edit screen, so the next save removed it. A 0 entry is now kept and passed to the field type’s sanitizer like any other entry: repeatable text_url stores the field…
   • Fixed a repeatable field saving its hidden “empty row” template as an extra row on every save. This happened when the template had a value, such as a repeatable select without show_option_none (its first option was saved) or a field with a default. The template row’s inputs are now rendered with di…
   • Fixed wysiwyg fields inside a group not escaping their saved value in the editor. The editor now loads the content exactly as saved: entities such as &amp; are no longer decoded on load (and then saved decoded), and saved markup such as a </textarea> tag stays inside the editor. Props Jakub Herman…
   • Fixed removing the only row of a repeatable field inside a group adding an empty row to the other repeatable fields in that group and its other entries. The reset now fires cmb2_add_row once, on the clicked field’s table, instead of once per repeatable table in the group, and removing the last row…

2. CMB2 2.13.4

   Oct 9, 2026
   • Added the rest_enforce_user_read_permissions box property and the cmb2_rest_enforce_user_read_permissions filter (off by default). When enabled, REST field reads of a user that core does not show (a user with no published posts, read by someone other than that user or a holder of edit_user/list_use…
   • Updated the alpha color picker script (wp-color-picker-alpha) to 3.0.4. Alpha colorpicker fields now output data-alpha-enabled instead of data-alpha; if you set data-alpha yourself through a field’s attributes, rename it to data-alpha-enabled. Props Sajib Talukder (@stalukder03) (#1542).
   • [Development] Added Dependabot version updates for npm and GitHub Actions (monthly, one grouped PR per ecosystem), and applied its first round of dev-tooling and workflow action updates (#1567, #1568).
   • [Development] Restricted the GitHub Actions GITHUB_TOKEN to read-only in all workflows, and moved the Playwright workflow to Node 22.
   • [Development] Expanded SECURITY.md with an email fallback for reports, CVE handling and scope.
   • Object IDs that CMB2 reads from the request (user_id, c, tag_ID and post, used when a box has no object ID set) are now cast to integers, the way WordPress reads them on its own edit screens, and the oembed field escapes its data-objectid and data-objecttype attributes. Core save hooks pass explici…
   • The CMB2 REST field endpoints (/cmb2/v1/boxes/{box}/fields and /fields/{field}) now follow WordPress core’s REST read permissions for the requested object. Reads of a post in a non-public status (draft, pending, private, future, trash); of a post, or an attachment’s parent, whose type is not shown…
   • A REST field read in the same PHP process as an earlier read of a different object now returns the requested object’s value rather than the earlier object’s.

3. CMB2 2.13.3

   Oct 3, 2026
   • The CMB2 REST boxes/fields endpoints now validate the object_type and object_id parameters against the box’s registered object types. A request naming an object type the box is not registered for (a post-type box stores as post), or, for an options-page box, an option key other than the box’s own,…

4. CMB2 2.13.2

   Sep 30, 2026
   • Escaped stored values in default field displays, including admin columns and front-end display_cb output. Stored HTML in default text and text_money displays now appears as text. textarea_code preserves visible source and uses <pre class="cmb2-code"> in place of <xmp class="cmb2-code">; integration…

5. CMB2 2.13.1

   Sep 24, 2026
   • Tested up to WordPress 7.1.
   • Sanitized and escaped file_list field values, which were previously stored and rendered verbatim. Array keys must now be positive-integer attachment IDs, and URLs are sanitized with the field’s protocols on save and on render. Entries with a malformed key (including 0 and positional-list keys) or a…
   • Fixed a PHP 8 TypeError when displaying a file_list field containing a non-scalar value.
   • Gave the options-page setting CMB2 registers a sanitize_callback, which wp.org’s Plugin Check requires of every register_setting() call. It is a passthrough by design: values are already sanitized per field type before the option is saved. Props @rubengc (#1533).
   • Removed the en@pirate translation files, whose @ in the filename fails wp.org’s plugin submission checks for any plugin bundling CMB2. Props @rubengc (#1533).

6. CMB2 2.13.0

   Sep 21, 2026
   • Added a rest_read_capability box property (also accepted as a field parameter) which declares who may read a box, or a single field on it, through the CMB2 REST API. The values read as plain English: false means no one, true means everyone (logged-out visitors included), 'box-capability' means hold…
   • Added a site-wide cmb2_rest_enforce_options_page_read_permissions filter which aligns REST reads of options-page boxes with WordPress core’s settings/options convention, gating them behind the box capability rather than serving them publicly. It defaults to false, preserving CMB2’s current behavior…
   • Added a dismissible admin notice for sites which register a REST-readable options-page box and have neither declared a rest_read_capability on it nor enabled the filter above. It links the REST API Read Permissions guide so those sites can pick the setting they want ahead of a later default change…
   • [Development] Added a SECURITY.md security policy and enabled GitHub private vulnerability reporting, giving researchers a private channel that does not depend on email delivery.
   • Aligned the oEmbed AJAX handler’s permission checks with CMB2’s other write paths: the handler now requires the caller to hold rights over the object the embed result is cached against (edit_post, edit_user, edit_comment, the taxonomy’s edit_terms, or, for an options-page target, the capability of…
   • Fixed CMB2_Base::maybe_hook_parameter() turning a caller’s default value into a declared box/field parameter. It passed the default through to prop(), which caches a truthy fallback on the object, so one request’s default persisted as a real parameter for every later call. Only a declared parameter…
   • Sanitized the field_id input (with an isset() guard) and escaped the rel attribute in the oEmbed AJAX handler, addressing a reflected XSS vector flagged by WordPress Plugin Check. Props @thisismyurl (#1559).
   • Escaped the metabox ID output in the options-page form and the field ID output in the repeatable-field wrapper (id and data-selector attributes) with esc_attr(), resolving unescaped HTML attribute output flagged by WordPress Coding Standards. Props @thisismyurl (#1560).

7. CMB2 2.12.0

   May 31, 2026
   • Confirmed compatibility with PHP 8.2 and 8.3, and tested up to WordPress 7.0.
   • [Development] Migrated end-to-end testing from Cypress to Playwright and replaced Grunt with npm scripts for the asset build pipeline. (#1550).
   • [Development] Moved the local development and test environment to @wordpress/env (wp-env) on pinned ports, running both PHPUnit and Playwright through it. (#1554, #1558).
   • [Development] Replaced Travis CI with GitHub Actions, added a PHPCompatibility check (PHP 7.4+) and a PHPCS/WPCS lint gate, and overhauled install-wp-tests.sh for modern WordPress. (#1555).
   • Fixed a PHP 8.1+ deprecation when sanitizing an empty textarea-based field (passing null to wp_kses_post()). Props @baljindersingh88 (#1537).
   • Fixed row iterator value desync between the data attribute and jQuery data when reordering repeatable group rows. Props @angryaxi (#1518).
   • Fixed a PHP 8.3 ltrim() deprecation in the taxonomy field display.
   • Hardened against PHP 8.2+ dynamic property deprecations by widening #[AllowDynamicProperties] to the class roots.
   • Removed a focus-background rule on .cmb2-wrap inputs that caused unexpected input styling. Fixes #1556/wordpress.org/support/topic/weird-checkbox-behaviour-on-wp-7 (#1557).