WordPress security changelog
HIGH CVE-2026-88783 Deferred

Kubio AI Page Builder: Stored XSS through a globally widened HTML allowlist

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder WordPress plugin before 2.9.3's own script later executes in the browser of any visitor, or of an administrator reviewing the still-unapproved submission. The authoritative export identifies the fixed release as 2.9.3.

CVE / CNA score 8.8 CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
NVD score Pending NVD has not published its own CVSS assessment.
Component
Kubio AI Page Builder
Plugin slug
kubio
Affected
< 2.9.3
Safe version
2.9.3
Published
Oct 03, 2026
Weakness
CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

This CVE was published Oct 03, 2026 and is one of 11 known issues for this plugin.

What to do

Update, patch or deactivate.

Update Kubio AI Page Builder to 2.9.3 or a later supported release. An application-level fix should scope expanded HTML allowances strictly to authorized editor operations and keep the restrictive policy for public submissions. Remove stored executable markup, including unapproved submissions.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder WordPress plugin before 2.9.3's own script later executes in the browser of any visitor, or of an administrator reviewing the still-unapproved submission.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Primary and upstream sources