Kubio AI Page Builder <= 2.9.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content

ID

WPSEC-2026-0052

Plugin

Kubio AI Page Builder (kubio)

Affected

all versions before 2.9.3

Remediation

Update to 2.9.3 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness

CWE-79

Usage

Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22

Attack surface

Kubio AI Page Builder on WPSec AttackSurface

Fix released

2026-09-30

Published

2026-10-01

Description

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via comment content and user profile biographies in all versions up to, and including, 2.9.1. This is due to the plugin's wp_kses_allowed_html filter adding SVG elements, together with id, class and arbitrary data-* attributes, to every sanitization context instead of only the 'post' context where Kubio renders SVG. This makes it possible for unauthenticated attackers on sites that allow comments (and subscriber-level users via their biography) to store SVG markup carrying data-* attributes that WordPress would normally strip. On pages that also load a script driven by those attributes, such as the fancyBox lightbox Kubio adds for lightbox links and galleries, the injected attributes can execute arbitrary web scripts when a user clicks the injected element.

References

• https://wpsec.com/vuln/WPSEC-2026-0052/
• https://plugins.svn.wordpress.org/kubio/tags/2.9.3/
• https://wordpress.org/plugins/kubio/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS