Kubio AI Page Builder vulnerabilities

The Kubio AI Page Builder plugin for WordPress is vulnerable to stored XSS via the 'comment' parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject scripts that execute when a user accesses an injected page.

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kubio/copyright Block Content in all versions up to and including 2.8.4 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page. This bypasses both WordPress core kses-on-save and the plugin's own wp_kses_post() because entity-encoded script tags are treated as inert text but decoded into live HTML.

The Kubio AI Page Builder plugin for WordPress up to version 2.8.5 is vulnerable to authorization bypass. Improper permission verification allows authenticated attackers with contributor-level access to overwrite front-page configuration, rewrite navigation menus, replace template parts, and overwrite global data. The nonce is available to all block editor users, making it ineffective.