Quick answers
- Is CVE-2026-115816 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-115816 being exploited in the wild.
- How severe is CVE-2026-115816?
- Medium severity, with a CVSS score of 6.4, published 7 November 2026.
- Which products and versions are affected?
- Kubio AI Page Builder up to 2.9.4.
- Is there a fix for CVE-2026-115816?
- No fixed version is recorded yet. Restrict review moderation to administrators and disable automatic approval of reviews; upgrade to a version with proper input sanitization and output escaping once available. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-115816 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-115816?
- Check whether you run Kubio AI Page Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Restrict review moderation to administrators and disable automatic approval of reviews; upgrade to a version with proper input sanitization and output escaping once available.
Technical details
The plugin contains a stored cross-site scripting (XSS) vulnerability in the review comment body parameter due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or above can inject arbitrary JavaScript into product reviews; the payload executes when a visitor loads a product page rendered with a Kubio-generated wp:post-content block, provided the malicious review has been approved.
Affected products
- Kubio AI Page Builder up to 2.9.4
Timeline
- 2026-11-07: disclosed