Kubio AI Page Builder <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Item Link
- ID
- WPSEC-2026-0053
- Plugin
- Kubio AI Page Builder (kubio)
- Affected
- from 1.3.0 before 2.9.3
- Remediation
- Update to 2.9.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Kubio AI Page Builder on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-88782, on 2026-10-01.
Description
The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image gallery block's item link in versions 1.3.0 to 2.9.1. This is due to the gallery item's 'url' block attribute being used as the link href, when the item's attachment ID does not resolve to an image, with only esc_attr() applied and no validation of the URL scheme. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts through javascript: URLs that execute when a user clicks the gallery image.
References
- https://wpsec.com/vuln/WPSEC-2026-0053/
- https://plugins.svn.wordpress.org/kubio/tags/2.9.3/
- https://wordpress.org/plugins/kubio/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS