Is CVE-2026-14472 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14472 being exploited in the wild.

How severe is CVE-2026-14472?

Medium severity, with a CVSS score of 6.4, published 18 September 2026.

Which products and versions are affected?

Kubio AI Page Builder up to 2.8.4.

Is there a fix for CVE-2026-14472?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14472 attacked?

It is attacked over the network.

Am I affected by CVE-2026-14472?

Check whether you run Kubio AI Page Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14472: Kubio AI Page Builder Stored XSS via copyright block

CVE-2026-14472 · Severity: medium · CVSS 6.4 · Published 2026-09-18

The Kubio AI Page Builder is a WordPress plugin that allows site administrators to create pages using a drag-and-drop interface. A vulnerability in the copyright block component allows authenticated contributors to inject malicious scripts into pages; these scripts execute for all visitors who view the affected page, potentially leading to account compromise, data theft, or defacement. The vulnerability bypasses WordPress's built-in content filtering mechanisms.

Technologies: Kubio AI Page Builder. Vendors: Kubio.

Quick answers

Is CVE-2026-14472 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14472 being exploited in the wild.
How severe is CVE-2026-14472?: Medium severity, with a CVSS score of 6.4, published 18 September 2026.
Which products and versions are affected?: Kubio AI Page Builder up to 2.8.4.
Is there a fix for CVE-2026-14472?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14472 attacked?: It is attacked over the network.
Am I affected by CVE-2026-14472?: Check whether you run Kubio AI Page Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the CopyrightBlock::render_template() method of the Kubio plugin. The root cause is that entity-encoded script tags are treated as harmless text by WordPress's kses sanitization filter, but are then decoded back into executable HTML by a subsequent html_entity_decode() call, allowing the malicious script to execute in visitors' browsers. An authenticated attacker with contributor-level access or higher can inject the payload via the copyright block content field. Patches addressing the issue are available in plugin versions after 2.8.4.

Affected products

Kubio AI Page Builder up to 2.8.4

Timeline

2026-09-18: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.