CVE-2026-115816 Kubio AI Page Builder <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via kubio/shortcode Block via Product Review

Description

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (review body)' parameter in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the attacker's review containing the payload to be approved, either automatically (due to a previously approved review from the same account) or manually by an administrator, and the active single-product template must use a Kubio-rendered wp:post-content block.

Exploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.

Attack vector

Network

Attack complexity

Low

Privileges required

Low

Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected products and versions