Stored Cross-Site Scripting (XSS) Vulnerability Affecting the Kubio AI Page Builder WordPress Plugin
Kubio AI Page Builder is a website design tool for WordPress that allows you to create layouts through a visual interface. It uses Artificial Intelligence to automatically generate and personalize pages.
Description
Technical context and vulnerability details
This plugin is affected by a vulnerability labeled CVE-2026-34887 which results from poor handling of user input. Exploitation of this vulnerability would allow an attacker to inject arbitrary scripts into plugin configuration settings via REST API endpoints. This code is then executed in the users' browser when viewing the site. This vulnerability is classified medium with a severity score of 6.5 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Data integrity breach;
- Data privacy breach;
- Theft of sensitive data;
Affected systems
Products, components and targeted versions
- All versions of Kubio AI Page Builder earlier than or equal to 2.7.0;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update the Kubio AI Page Builder plugin to its latest available stable version;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.