Stored Cross-Site Scripting Vulnerability in Kubio AI Page Builder for WordPress

CVE-2026-14472

What is CVE-2026-14472?

The Kubio AI Page Builder plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability via the kubio/copyright Block Content. This weakness exists due to inadequate input sanitization and output escaping in all versions up to and including 2.8.4. Authenticated attackers with contributor-level access or higher can exploit this flaw to inject arbitrary web scripts into pages. These scripts will execute whenever a user views the affected page, circumventing both the native WordPress kses-on-save filter and the plugin’s own wp_kses_post() function, as entity-encoded script elements are perceived as harmless text but are converted into active HTML by the html_entity_decode() call in the CopyrightBlock::render_template() method.

References