Ai Builder
Monthly
Stored XSS in the AI Builder WordPress plugin (versions 2.4.1 through <2.7.8) allows any authenticated contributor-level user to inject persistent JavaScript via an unsanitized custom JS field, which executes in the browser of every subsequent viewer - including editors and administrators who review the post. This creates a reliable privilege-escalation path from contributor to full WordPress site administrator via session token theft or forced admin-action execution. Publicly available exploit code exists per WPScan, and a vendor-released patch is available in version 2.7.8.
Stored XSS in the AI Builder WordPress plugin (versions 2.4.1 through <2.7.8) allows any authenticated contributor-level user to inject persistent JavaScript via an unsanitized custom JS field, which executes in the browser of every subsequent viewer - including editors and administrators who review the post. This creates a reliable privilege-escalation path from contributor to full WordPress site administrator via session token theft or forced admin-action execution. Publicly available exploit code exists per WPScan, and a vendor-released patch is available in version 2.7.8.