CVE-2026-88783

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-03

Last updated on: 2026-10-06

Assigner: WPScan

Description

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder WordPress plugin before 2.9.3's own script later executes in the browser of any visitor, or of an administrator reviewing the still-unapproved submission.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-03

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-03

EPSS Evaluated

2026-10-18

NVD

CVE-2026-88783

EUVD

EUVD-2026-91942

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Kubio	AI Page Builder 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is an unauthenticated stored Cross-Site Scripting (XSS) vulnerability in the Kubio AI Page Builder WordPress plugin before version 2.9.3. The plugin fails to limit allowed HTML elements to the editor context, applying a broader set when filtering content from unauthenticated users. Attackers can submit malicious markup that the plugin's script later executes in browsers of visitors or administrators reviewing unapproved submissions.

Detection Guidance

Check if the Kubio AI Page Builder WordPress plugin version is below 2.9.3. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details in the WordPress admin panel.

Impact Analysis

Attackers could inject malicious scripts into your WordPress site, potentially stealing user data, session cookies, or performing actions on behalf of users. Visitors or admins reviewing unapproved content could have their browsers compromised without needing to log in.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Unauthorized script execution may expose sensitive user data, resulting in compliance violations and potential legal penalties.

Mitigation Strategies

Update the Kubio AI Page Builder plugin to version 2.9.3 or later immediately. Disable the plugin temporarily if an update is not immediately available.

Hi! I’m here to help you understand CVE-2026-88783. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70