Executive brief
The Kubio AI Page Builder is a WordPress plugin that allows site administrators to create pages using a drag-and-drop interface. A vulnerability in the copyright block component allows authenticated contributors to inject malicious scripts into pages; these scripts execute for all visitors who view the affected page, potentially leading to account compromise, data theft, or defacement. The vulnerability bypasses WordPress's built-in content filtering mechanisms.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the CopyrightBlock::render_template() method of the Kubio plugin. The root cause is that entity-encoded script tags are treated as harmless text by WordPress's kses sanitization filter, but are then decoded back into executable HTML by a subsequent html_entity_decode() call, allowing the malicious script to execute in visitors' browsers. An authenticated attacker with contributor-level access or higher can inject the payload via the copyright block content field. Patches addressing the issue are available in plugin versions after 2.8.4.
Affected products
- Kubio AI Page Builder up to 2.8.4
Timeline
- 2026-09-18: disclosed