EUVD-2026-91942
GHSA-w96f-q24m-hc95
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Unauthenticated remote stored XSS (PR:N, AV:N, AC:L) needing a victim to view content (UI:R); S:C and C:L/I:L reflect script crossing into the browser context, with no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder WordPress plugin before 2.9.3's own script later executes in the browser of any visitor, or of an administrator reviewing the still-unapproved submission.
AnalysisAI
Stored cross-site scripting in the Kubio AI Page Builder WordPress plugin before 2.9.3 lets unauthenticated attackers submit HTML markup that passes the plugin's content filtering and is later executed by the plugin's own front-end script in the browser of any site visitor, or of an administrator reviewing the still-unapproved submission. The flaw is one of scope: the widened HTML element allowlist the plugin applies for its editor context is also applied when filtering content submitted by unauthenticated users, so markup that should never survive sanitisation does. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the site accept content submissions from unauthenticated users which pass through the plugin's HTML filtering - the flaw is that the widened editor-context element allowlist is incorrectly applied to this unauthenticated submission path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals here point in genuinely different directions, so this is a moderate-priority patch rather than an emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the Kubio AI Page Builder WordPress plugin to 2.9.3 or later, per the vendor advisory and the WPScan entry at https://wpscan.com/vulnerability/94d11df1-dae7-479f-bc93-3db6b0925d99/; additional context is in https://vuldb.com/vuln/413299. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations for Kubio AI Page Builder versions before 2.9.3 and apply the vendor-released patch to version 2.9.3; if immediate patching is not possible, disable the plugin, restrict unauthenticated content submissions, and block known XSS payloads at the WAF. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubio Ai Page Builder
View allStored cross-site scripting in the Kubio AI Page Builder WordPress plugin (all versions before 2.9.3) lets a user holdin
Unauthenticated stored cross-site scripting (XSS) in Kubio AI Page Builder up to and including version 2.9.2 allows remo
Stored cross-site scripting (XSS) in Extend Themes Kubio AI Page Builder through version 2.7.0 allows authenticated user
Stored cross-site scripting in the Kubio AI Page Builder plugin for WordPress (all versions up to and including 2.8.4) l
Kubio page builder plugin for WordPress allows authenticated attackers with Contributor-level access to upload arbitrary
Authorization bypass in Kubio AI Page Builder (WordPress plugin, all versions ≤2.8.5) enables any authenticated Contribu
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today