What is the CVSS score of EUVD-2026-91252?

EUVD-2026-91252 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Kubio AI Page Builder are affected by EUVD-2026-91252?

Kubio AI Page Builder, a WordPress page-building plugin installed on sites up to and including version 2.9.2, contains a stored cross-site scripting flaw that lets an attacker plant malicious script…

How to fix or mitigate EUVD-2026-91252?

Within 24 hours, inventory all WordPress installations running Kubio AI Page Builder at version 2.9.2 or earlier, confirm the version through the plugin management console or by inspecting the plugin directory, and where the plugin is not business-critical temporarily deactivate and remove it or restore a known-good backup taken before any suspicious content was added; deploy virtual patching through the existing WAF or reverse proxy to block script payloads submitted through page and comment fields, and review recent page and comment content for unexpected script tags. Within 7 days, apply compensating controls to any site that must keep the plugin active, including a strict Content Security Policy, server-side output encoding, restriction of content-submission privileges to trusted accounts, and heightened logging and alerting on administrative sessions; monitor the vendor advisory and the upstream repository for a released fix and test it in a staging environment as soon as it appears. Within 30 days, either upgrade to the first vendor-released version that addresses CVE-2026-100107 or migrate affected sites to an alternative page builder, and validate the remediation by rescanning all instances, re-checking stored page content for residual payloads, and rotating administrative credentials and session tokens on any site where injected content was found.

Kubio AI Page Builder EUVD-2026-91252

| CVE-2026-100107 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-10-02 Wordfence

GHSA-qhmm-qvx2-27pr

WordPress XSS Kubio Ai Page Builder Wordpress Plugin Extendthemes

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Unauthenticated network-reachable comment input (AV:N/PR:N/AC:L); stored script auto-executes on page load (UI:N) in victim browser crossing security scope (S:C) with limited C/I impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Oct 02, 2026 - 08:20 vuln.today

CVE Published

Oct 02, 2026 - 07:39 cve.org

HIGH 7.2

DescriptionCVE.org

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Unauthenticated stored cross-site scripting (XSS) in Kubio AI Page Builder up to and including version 2.9.2 allows remote attackers to inject arbitrary web scripts via the 'comment' parameter, which execute when a victim visits an injected page. The vulnerability has a CVSS score of 7.2 and a scope change, but no public exploit code has been identified and there is no evidence of active exploitation. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the Kubio AI Page Builder plugin (vendor extendthemes) version ≤2.9.2 to be installed and active on a WordPress site, with the 'comment' parameter input path reachable; per PR:N the attacker needs no authentication and no special non-default configuration is indicated. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine, actionable medium-to-high priority flaw rather than an inflated high-CVSS artifact, but it is not a top-tier emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patched version is explicitly confirmed; however, an upstream fix exists in Trac changeset 3720531 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3720531%40kubio&new=3720531%40kubio). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all WordPress installations running Kubio AI Page Builder at version 2.9.2 or earlier, confirm the version through the plugin management console or by inspecting the plugin directory, and where the plugin is not business-critical temporarily deactivate and remove it or restore a known-good backup taken before any suspicious content was added; deploy virtual patching through the existing WAF or reverse proxy to block script payloads submitted through page and comment fields, and review recent page and comment content for unexpected script tags. …

Threat intelligence, references, and detailed analysis are available after sign-in.