Kubio Ai Page Builder CVE-2026-34887

The CVSS v3.1 score of 6.5 (Medium) reflects a network-based attack with low complexity and limited impact scope. However, the risk profile merits careful consideration: the vulnerability requires PR:L (authenticated access), which reduces the attacker population but is not negligible given that WordPress sites often have multiple user accounts. The UI:R (requires user interaction) flag indicates victims must view the malicious page, though stored XSS automatically triggers this for any user accessing the compromised page. The CVSS C:L/I:L/A:L vector shows limited direct confidentiality, integrity, and availability impact, yet stored XSS can enable privilege escalation, session hijacking, and account takeover depending on the attacker's objective. The Medium CVSS rating appropriately captures the real-world risk: this is not a critical RCE or authentication bypass, but it is a persistent threat to site integrity and user security, particularly on multi-user WordPress installations.

A malicious WordPress editor or author (or an attacker who compromises such an account) uses the Kubio AI Page Builder to create or edit a page, injecting XSS payload into a page title, content field, or page builder element that lacks proper escaping. The malicious page is published and indexed. When site visitors or administrators view the page, the injected JavaScript executes in their browsers with the same privileges as their authenticated session, allowing the attacker to steal session cookies, capture form data, or redirect users to phishing sites.