CVE-2026-88783
Kubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment Content
Unknown Kubio AI Page Builder
CVSS
8.8HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.9.3Kubio AI Page BuilderCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder WordPress plugin before 2.9.3's own script later executes in the browser of any visitor, or of an administrator reviewing the still-unapproved submission.
Text from CVE List
Affected versions 1
- Kubio AI Page Builderaffected: all versions before 2.9.3CVE List