Kubio Ai Page Builder
Monthly
Reflected cross-site scripting in the WordPress plugin Kubio AI Page Builder (Extend Themes) affects every release through 2.9.3 and lets a remote, unauthenticated attacker craft a URL that causes the plugin's request-handling endpoint to echo attacker-supplied input back into the generated page without proper neutralization; the payload then executes in the browser of any user who is lured into opening that link, with the scope-change flag indicating the injected script can reach beyond the plugin's own security context (for example, an authenticated WordPress administrator's session). Exploitation requires victim interaction (UI:R) - a targeted user must click the crafted link, and the impact is most meaningful against logged-in or privileged users - while no privileges are needed on the attacker side (PR:N) and complexity is low (AC:L), giving an assessed CVSS 3.1 base score of 7.1 (High). At the time of analysis no public exploit code and no confirmed active exploitation were identified, and no EPSS data was supplied; sites running a release later than 2.9.3 are not affected.
Stored cross-site scripting in the Kubio AI Page Builder WordPress plugin before 2.9.3 lets unauthenticated attackers submit HTML markup that passes the plugin's content filtering and is later executed by the plugin's own front-end script in the browser of any site visitor, or of an administrator reviewing the still-unapproved submission. The flaw is one of scope: the widened HTML element allowlist the plugin applies for its editor context is also applied when filtering content submitted by unauthenticated users, so markup that should never survive sanitisation does. Publicly available exploit code exists (referenced by WPScan), but EPSS is only 0.17% (6th percentile) and CISA's SSVC assessment records no exploitation and no automatable path, so this is a moderate-priority patch rather than an emergency; the vendor-published CVSS of 8.8 (S:U) is more severe than our independently assessed vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, and the difference is largely scope and impact rating rather than exploitability.
Unauthenticated stored cross-site scripting (XSS) in Kubio AI Page Builder up to and including version 2.9.2 allows remote attackers to inject arbitrary web scripts via the 'comment' parameter, which execute when a victim visits an injected page. The vulnerability has a CVSS score of 7.2 and a scope change, but no public exploit code has been identified and there is no evidence of active exploitation. A vendor patch version is not confirmed, though an upstream code change exists.
Stored cross-site scripting in the Kubio AI Page Builder WordPress plugin (all versions before 2.9.3) lets a user holding the contributor role or higher save a link whose target uses an unvalidated URI scheme - such as javascript: - so that the payload executes in the browser of any person who follows that link, most damagingly an administrator previewing the contributor's unpublished submission. Publicly available exploit code exists, so reproduction is straightforward for anyone with contributor-level access on a site that grants untrusted users that role (self-registration enabled or another route to an account); exploitation additionally requires the admin to preview or click the crafted link, which is why CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no'. EPSS is low at 0.15% (4th percentile) and there is no indication of confirmed active exploitation (no CISA KEV listing), though successful execution against an admin session could yield full site takeover given the privileges at stake.
Stored cross-site scripting in the Kubio AI Page Builder plugin for WordPress (all versions up to and including 2.8.4) lets authenticated users with contributor-level access or higher embed HTML-entity-encoded script markup inside the kubio/copyright block, which the plugin subsequently decodes back into live HTML and renders to anyone who views the page. Because the payload survives both the WordPress core kses-on-save filter and the plugin's own wp_kses_post() call, the injected script executes in the browser of an admin, editor, or visitor who loads the affected content; the attacker needs no further interaction after saving the post. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) consistent with an authenticated-authoring prerequisite and cross-user impact; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Authorization bypass in Kubio AI Page Builder (WordPress plugin, all versions ≤2.8.5) enables any authenticated Contributor to overwrite front-page configuration options, rewrite primary navigation menus, replace template parts, and overwrite the plugin's global-data post. The plugin emits the AJAX nonce unconditionally into the JavaScript global window.kubioUtilsData for every user who can load the block editor - including Contributors - making the check_ajax_referer() call a non-functional authorization barrier. No public exploit identified at time of analysis, but the exploitation mechanism is fully documented in the Wordfence advisory and the vulnerable code paths are publicly visible in the WordPress plugin Trac repository.
Kubio page builder plugin for WordPress allows authenticated attackers with Contributor-level access to upload arbitrary files from external URLs by bypassing capability checks in the REST API post creation handler. The kubio_rest_pre_insert_import_assets() function automatically imports remote files referenced in block attributes without verifying the user possesses the upload_files capability, violating WordPress's normal media upload restrictions. Affected versions are up to and including 2.7.2; no public exploit code has been identified at the time of analysis.
Stored cross-site scripting (XSS) in Extend Themes Kubio AI Page Builder through version 2.7.0 allows authenticated users to inject malicious scripts that execute in the browsers of other users viewing affected pages. An attacker with user account access can inject unescaped input during page generation, leading to session hijacking, credential theft, or malware distribution. No public exploit code has been identified at the time of analysis.
Reflected cross-site scripting in the WordPress plugin Kubio AI Page Builder (Extend Themes) affects every release through 2.9.3 and lets a remote, unauthenticated attacker craft a URL that causes the plugin's request-handling endpoint to echo attacker-supplied input back into the generated page without proper neutralization; the payload then executes in the browser of any user who is lured into opening that link, with the scope-change flag indicating the injected script can reach beyond the plugin's own security context (for example, an authenticated WordPress administrator's session). Exploitation requires victim interaction (UI:R) - a targeted user must click the crafted link, and the impact is most meaningful against logged-in or privileged users - while no privileges are needed on the attacker side (PR:N) and complexity is low (AC:L), giving an assessed CVSS 3.1 base score of 7.1 (High). At the time of analysis no public exploit code and no confirmed active exploitation were identified, and no EPSS data was supplied; sites running a release later than 2.9.3 are not affected.
Stored cross-site scripting in the Kubio AI Page Builder WordPress plugin before 2.9.3 lets unauthenticated attackers submit HTML markup that passes the plugin's content filtering and is later executed by the plugin's own front-end script in the browser of any site visitor, or of an administrator reviewing the still-unapproved submission. The flaw is one of scope: the widened HTML element allowlist the plugin applies for its editor context is also applied when filtering content submitted by unauthenticated users, so markup that should never survive sanitisation does. Publicly available exploit code exists (referenced by WPScan), but EPSS is only 0.17% (6th percentile) and CISA's SSVC assessment records no exploitation and no automatable path, so this is a moderate-priority patch rather than an emergency; the vendor-published CVSS of 8.8 (S:U) is more severe than our independently assessed vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, and the difference is largely scope and impact rating rather than exploitability.
Unauthenticated stored cross-site scripting (XSS) in Kubio AI Page Builder up to and including version 2.9.2 allows remote attackers to inject arbitrary web scripts via the 'comment' parameter, which execute when a victim visits an injected page. The vulnerability has a CVSS score of 7.2 and a scope change, but no public exploit code has been identified and there is no evidence of active exploitation. A vendor patch version is not confirmed, though an upstream code change exists.
Stored cross-site scripting in the Kubio AI Page Builder WordPress plugin (all versions before 2.9.3) lets a user holding the contributor role or higher save a link whose target uses an unvalidated URI scheme - such as javascript: - so that the payload executes in the browser of any person who follows that link, most damagingly an administrator previewing the contributor's unpublished submission. Publicly available exploit code exists, so reproduction is straightforward for anyone with contributor-level access on a site that grants untrusted users that role (self-registration enabled or another route to an account); exploitation additionally requires the admin to preview or click the crafted link, which is why CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no'. EPSS is low at 0.15% (4th percentile) and there is no indication of confirmed active exploitation (no CISA KEV listing), though successful execution against an admin session could yield full site takeover given the privileges at stake.
Stored cross-site scripting in the Kubio AI Page Builder plugin for WordPress (all versions up to and including 2.8.4) lets authenticated users with contributor-level access or higher embed HTML-entity-encoded script markup inside the kubio/copyright block, which the plugin subsequently decodes back into live HTML and renders to anyone who views the page. Because the payload survives both the WordPress core kses-on-save filter and the plugin's own wp_kses_post() call, the injected script executes in the browser of an admin, editor, or visitor who loads the affected content; the attacker needs no further interaction after saving the post. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) consistent with an authenticated-authoring prerequisite and cross-user impact; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Authorization bypass in Kubio AI Page Builder (WordPress plugin, all versions ≤2.8.5) enables any authenticated Contributor to overwrite front-page configuration options, rewrite primary navigation menus, replace template parts, and overwrite the plugin's global-data post. The plugin emits the AJAX nonce unconditionally into the JavaScript global window.kubioUtilsData for every user who can load the block editor - including Contributors - making the check_ajax_referer() call a non-functional authorization barrier. No public exploit identified at time of analysis, but the exploitation mechanism is fully documented in the Wordfence advisory and the vulnerable code paths are publicly visible in the WordPress plugin Trac repository.
Kubio page builder plugin for WordPress allows authenticated attackers with Contributor-level access to upload arbitrary files from external URLs by bypassing capability checks in the REST API post creation handler. The kubio_rest_pre_insert_import_assets() function automatically imports remote files referenced in block attributes without verifying the user possesses the upload_files capability, violating WordPress's normal media upload restrictions. Affected versions are up to and including 2.7.2; no public exploit code has been identified at the time of analysis.
Stored cross-site scripting (XSS) in Extend Themes Kubio AI Page Builder through version 2.7.0 allows authenticated users to inject malicious scripts that execute in the browsers of other users viewing affected pages. An attacker with user account access can inject unescaped input during page generation, leading to session hijacking, credential theft, or malware distribution. No public exploit code has been identified at the time of analysis.