CVE-2026-14472
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kubio/copyright Block Content in all versions up to and including 2.8.4 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page. This bypasses both WordPress core kses-on-save and the plugin's own wp_kses_post() because entity-encoded script tags are treated as inert text but decoded into live HTML.
Risk Assessment
An attacker could steal user data, hijack sessions, or spread malicious content. This may lead to compromise of user security and site reputation.
Recommendation
Update the Kubio AI Page Builder plugin to the latest version with the fix. Additionally, consider using a web application firewall (WAF) and regularly scan the site for XSS.
Other vulnerabilities in Kubio AI Page Builder
See all- CVE-2026-100107High
The Kubio AI Page Builder plugin for WordPress is vulnerable to stored XSS via the 'comment' parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject scripts that execute when a user accesses an injected page.
- CVE-2026-16779Medium
The Kubio AI Page Builder plugin for WordPress up to version 2.8.5 is vulnerable to authorization bypass. Improper permission verification allows authenticated attackers with contributor-level access to overwrite front-page configuration, rewrite navigation menus, replace template parts, and overwrite global data. The nonce is available to all block editor users, making it ineffective.
Original NVD description (English source)
The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kubio/copyright Block Content in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This bypasses both the WordPress core kses-on-save filter and the plugin's own wp_kses_post() call, because entity-encoded script tags are treated as inert text by kses but are decoded into live HTML by the subsequent html_entity_decode() call in CopyrightBlock::render_template().
Vulnerability data from NVD (NIST) · CISA KEV · EPSS