CVE-2026-88783
Received Received - Intake

Stored XSS in Kubio AI Page Builder WordPress Plugin

Publication date: 2026-10-03

Last updated on: 2026-10-03

Assigner: WPScan

Description
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder WordPress plugin before 2.9.3's own script later executes in the browser of any visitor, or of an administrator reviewing the still-unapproved submission.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-03
Last Modified
2026-10-03
Generated
2026-10-03
AI Q&A
2026-10-03
EPSS Evaluated
N/A
NVD
CVE-2026-88783
EUVD
EUVD-2026-91942

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kubio ai_page_builder to 2.9.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated stored Cross-Site Scripting (XSS) vulnerability in the Kubio AI Page Builder WordPress plugin before version 2.9.3. The plugin fails to limit allowed HTML elements to the editor context, applying a broader set when filtering content from unauthenticated users. Attackers can submit malicious markup that the plugin's script later executes in browsers of visitors or administrators reviewing unapproved submissions.

Detection Guidance

Check if the Kubio AI Page Builder WordPress plugin version is below 2.9.3. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details in the WordPress admin panel.

Impact Analysis

Attackers could inject malicious scripts into your WordPress site, potentially stealing user data, session cookies, or performing actions on behalf of users. Visitors or admins reviewing unapproved content could have their browsers compromised without needing to log in.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Unauthorized script execution may expose sensitive user data, resulting in compliance violations and potential legal penalties.

Mitigation Strategies

Update the Kubio AI Page Builder plugin to version 2.9.3 or later immediately. Disable the plugin temporarily if an update is not immediately available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88783. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart