EUVD-2026-91941
GHSA-gf46-mg37-6fp9
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor-level foothold means PR:L (not PR:H); admin must view/click so UI:R; script runs in the admin's browser context, a different authority, giving S:C with limited C/I and no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an administrator previewing the unpublished submission.
AnalysisAI
Stored cross-site scripting in the Kubio AI Page Builder WordPress plugin (all versions before 2.9.3) lets a user holding the contributor role or higher save a link whose target uses an unvalidated URI scheme - such as javascript: - so that the payload executes in the browser of any person who follows that link, most damagingly an administrator previewing the contributor's unpublished submission. Publicly available exploit code exists, so reproduction is straightforward for anyone with contributor-level access on a site that grants untrusted users that role (self-registration enabled or another route to an account); exploitation additionally requires the admin to preview or click the crafted link, which is why CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no'. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a WordPress account with the contributor role or higher on the target site (self-registration must be enabled or an account otherwise obtained), and it requires a higher-privileged victim - specifically an administrator - to preview the unpublished submission or follow the attacker-supplied link for the stored payload to execute. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a stored cross-site scripting flaw (CWE-79) carrying a moderate CVSS of 6.8 (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the Kubio AI Page Builder plugin to version 2.9.3 or later, which addresses the missing URI-scheme validation; the fix is available from the vendor and is tracked in the WPScan advisory (https://wpscan.com/vulnerability/b45063f1-65a0-44cb-9565-0242f30fd7a3/), with corroborating entries at the NVD and VulDB links. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubio Ai Page Builder
View allStored cross-site scripting in the Kubio AI Page Builder WordPress plugin before 2.9.3 lets unauthenticated attackers su
Unauthenticated stored cross-site scripting (XSS) in Kubio AI Page Builder up to and including version 2.9.2 allows remo
Stored cross-site scripting (XSS) in Extend Themes Kubio AI Page Builder through version 2.7.0 allows authenticated user
Stored cross-site scripting in the Kubio AI Page Builder plugin for WordPress (all versions up to and including 2.8.4) l
Kubio page builder plugin for WordPress allows authenticated attackers with Contributor-level access to upload arbitrary
Authorization bypass in Kubio AI Page Builder (WordPress plugin, all versions ≤2.8.5) enables any authenticated Contribu
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today