Kubio AI Page Builder EUVD-2026-95630

Exploitation requires that a logged-in or targeted user be tricked into clicking an attacker-crafted URL that is reflected back by a vulnerable Kubio AI Page Builder request-handling endpoint (reflected XSS, UI:R). No authentication is required of the attacker (PR:N), but success is gated on victim interaction and on the victim having an active or privileged session for the payload to be meaningful - these user-interaction and session-context requirements are the primary limiting factors. Affected versions are from an unspecified earliest release through 2.9.3; sites running a later/patched version are not exploitable.

The CVSS 3.1 base score of 7.1 (High) is driven largely by the scope-change flag (S:C) applied to the reflected XSS, combined with network vector (AV:N), low complexity (AC:L), and no privileges (PR:N). However, the vector also requires user interaction (UI:R), which is the critical risk-limiting signal: a victim must be lured into clicking an attacker-crafted link, so this is not self-propagating or mass-automatable. No EPSS probability, CISA KEV entry, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The impact metrics are all Low (C:L/I:L/A:L), consistent with a reflected XSS that executes script in the victim's browser session rather than compromising the server. Net assessment: a legitimate High-severity web flaw worth patching promptly, but real-world risk is moderated by the mandatory social-engineering step and the absence of any exploitation-maturity signal - closer to a targeted/opportunistic phishing-style risk than a widespread automated threat. The A:L availability impact assigned upstream is questionable for a reflected XSS and should be treated with caution.

An attacker crafts a malicious URL targeting a vulnerable Kubio AI Page Builder endpoint that reflects unsanitized input into the generated page, then delivers it to a logged-in WordPress user or administrator via phishing or a malicious link. When the victim clicks it, attacker-controlled JavaScript executes in their browser in the site's context, enabling session/cookie theft or actions on the victim's behalf. No public POC is identified in the provided data, and successful exploitation depends on the victim interacting with the crafted link (UI:R).