HTML Injection Vulnerability in Kubio AI Page Builder by WordPress
CVE-2026-88783
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 3 October 2026
Badges
What is CVE-2026-88783?
The Kubio AI Page Builder plugin for WordPress before version 2.9.3 is susceptible to an HTML injection vulnerability. This flaw arises because the plugin fails to restrict the allowed HTML elements strictly to the editor context. Consequently, when unauthenticated users submit content, the plugin allows a broader range of HTML tags. These submissions can include malicious markup that is later executed in the browser by any visitor or an administrator reviewing unapproved content. This vulnerability poses a significant risk as it can lead to the execution of arbitrary script injections that may compromise the site’s integrity.
Affected Version(s)
Kubio AI Page Builder 0 < 2.9.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.