Stored Cross-Site Scripting Vulnerability in Kubio AI Page Builder Plugin for WordPress

CVE-2026-115816

What is CVE-2026-115816?

The Kubio AI Page Builder plugin for WordPress has a vulnerability allowing Stored Cross-Site Scripting through the 'comment (review body)' parameter. This issue arises from inadequate input sanitization and output escaping present in versions up to and including 2.9.4. Authenticated users with subscriber-level access and above can exploit this vulnerability to inject malicious web scripts into pages, which will execute when other users view these pages. Successful attacks require the malicious review to be approved, which may occur either automatically if a review from the same account has been previously approved or through manual approval by an administrator. The exploitation relies on the active use of a Kubio-rendered wp:post-content block.

References