Skip to content
Sign in
6.8 Medium

CVE-2026-88782 The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before…

Description

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an administrator previewing the unpublished submission.

Affected products and versions

Product Affected versions Fixed in
Kubio AI Page Builder 2.9 earliest → < 2.9.3 2.9.3

Other CVEs of Kubio AI Page Builder

The 2 CVEs of Kubio AI Page Builder →
CVE-2026-88783 The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to… 8.8 High
Track this CVE