{"id":"CVE-2026-115816","kind":"vulnerability","aliases":["CVE-2026-115816"],"related":[],"title":"Kubio AI Page Builder WordPress plugin: stored XSS via review body","description":"The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (review body)' parameter in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the attacker's review containing the payload to be approved, either automatically (due to a previously approved review from the same account) or manually by an administrator, and the active single-product template must use a Kubio-rendered wp:post-content block.","summary":"The Kubio AI Page Builder plugin for WordPress does not sanitize the review body field, so a logged-in subscriber can store script that runs in pages. The script runs for any user who opens an affected page after the review is approved.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kubio-ai-page-builder","package","woocommerce","wordpress"],"not_affected_if":["no-kubio-post-content-template","plugin-not-installed","reviews-not-approved"],"how_to_check":"- Check the installed Kubio AI Page Builder plugin version in the WordPress admin Plugins screen; versions up to and including `2.9.4` are affected.\n- Check whether the active single-product template uses a Kubio-rendered `wp:post-content` block.","fix":null,"status":"open","published_at":"2026-11-07T03:16:59+00:00","first_seen_at":"2026-11-07T03:45:32+00:00","triaged_at":"2026-11-07T03:45:36+00:00","updated_at":"2026-11-07T03:45:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T03:45:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Kubio AI Page Builder WordPress plugin: stored XSS via review body","impact":"medium","summary":"The Kubio AI Page Builder plugin for WordPress does not sanitize the review body field, so a logged-in subscriber can store script that runs in pages. The script runs for any user who opens an affected page after the review is approved.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","kubio-ai-page-builder","woocommerce"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker script runs in visitors' browsers on injected pages.","analyst_note":"Confirm the fixed version in the Wordfence or WordPress plugin changelog, since the sources give no fix.","how_to_check":"- Check the installed Kubio AI Page Builder plugin version in the WordPress admin Plugins screen; versions up to and including `2.9.4` are affected.\n- Check whether the active single-product template uses a Kubio-rendered `wp:post-content` block.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-kubio-post-content-template","reviews-not-approved"],"who_is_affected":"Sites running the Kubio AI Page Builder plugin at version 2.9.4 or earlier that use a Kubio-rendered single-product template. Exploitation needs a subscriber-level account and a review that is approved, either automatically or by an administrator. Sites without the plugin or without that template can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000728,"input_tokens":4361,"output_tokens":583,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115816':14A,17A '-2026':13A,16A '2.9.4':99C 'access':119C,135C 'account':163C 'activ':171C 'administr':168C 'affect':63B 'ai':2A,20B,28B,72C 'approv':69B,151C,158C 'arbitrari':124C 'attack':114C,143C 'authent':113C 'automat':153C 'block':186C 'bodi':11A,39B,90C 'builder':4A,22B,30B,74C 'comment':88C 'contain':146C 'content':185C 'cross':83C 'cross-sit':82C 'cve':12A,15A 'due':100C,154C 'either':152C 'escap':107C 'execut':131C 'exploit':140C 'field':40B 'includ':98C 'inject':123C,137C 'input':103C 'insuffici':102C 'kubio':1A,19B,27B,71C,180C 'kubio-ai-page-build':18B 'kubio-rend':179C 'level':118C 'log':44B 'logged-in':43B 'make':109C 'manual':165C 'must':176C 'open':61B 'output':106C 'packag':23B 'page':3A,21B,29B,53B,64B,73C,128C,138C 'paramet':91C 'payload':148C 'plugin':6A,31B,75C 'possibl':111C 'post':184C 'post-cont':183C 'previous':157C 'product':174C 'render':181C 'requir':141C 'review':10A,38B,67B,89C,145C,159C 'run':51B,56B 'sanit':36B,104C 'script':49B,55B,85C,126C 'singl':173C 'single-product':172C 'site':84C 'store':7A,48B,81C 'subscrib':46B,117C 'subscriber-level':116C 'success':139C 'templat':175C 'use':177C 'user':59B,134C 'version':94C 'via':9A,86C 'vulner':79C 'web':125C 'whenev':132C 'woocommerc':24B 'wordpress':5A,25B,33B,77C 'wp':182C 'xss':8A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Kubio AI Page Builder plugin at version 2.9.4 or earlier that use a Kubio-rendered single-product template. Exploitation needs a subscriber-level account and a review that is approved, either automatically or by an administrator. Sites without the plugin or without that template can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["kubioaipagebuilder","medium","package","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-115816':14A,17A '-2026':13A,16A 'ai':2A 'bodi':11A 'builder':4A 'cve':12A,15A 'kubio':1A 'page':3A 'plugin':6A 'review':10A 'store':7A 'via':9A 'wordpress':5A 'xss':8A","search_b":"'affect':63B 'ai':20B,28B 'approv':69B 'bodi':39B 'builder':22B,30B 'field':40B 'kubio':19B,27B 'kubio-ai-page-build':18B 'log':44B 'logged-in':43B 'open':61B 'packag':23B 'page':21B,29B,53B,64B 'plugin':31B 'review':38B,67B 'run':51B,56B 'sanit':36B 'script':49B,55B 'store':48B 'subscrib':46B 'user':59B 'woocommerc':24B 'wordpress':25B,33B","search_c":"'2.9.4':99C 'access':119C,135C 'account':163C 'activ':171C 'administr':168C 'ai':72C 'approv':151C,158C 'arbitrari':124C 'attack':114C,143C 'authent':113C 'automat':153C 'block':186C 'bodi':90C 'builder':74C 'comment':88C 'contain':146C 'content':185C 'cross':83C 'cross-sit':82C 'due':100C,154C 'either':152C 'escap':107C 'execut':131C 'exploit':140C 'includ':98C 'inject':123C,137C 'input':103C 'insuffici':102C 'kubio':71C,180C 'kubio-rend':179C 'level':118C 'make':109C 'manual':165C 'must':176C 'output':106C 'page':73C,128C,138C 'paramet':91C 'payload':148C 'plugin':75C 'possibl':111C 'post':184C 'post-cont':183C 'previous':157C 'product':174C 'render':181C 'requir':141C 'review':89C,145C,159C 'sanit':104C 'script':85C,126C 'singl':173C 'single-product':172C 'site':84C 'store':81C 'subscrib':117C 'subscriber-level':116C 'success':139C 'templat':175C 'use':177C 'user':134C 'version':94C 'via':86C 'vulner':79C 'web':125C 'whenev':132C 'wordpress':77C 'wp':182C","first_public_at":"2026-11-07T03:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115816","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115816","severity":null,"published_at":"2026-11-07T03:16:59+00:00","modified_at":"2026-11-07T03:16:59+00:00","first_seen_at":"2026-11-07T03:45:32+00:00","fetched_at":"2026-11-07T03:45:32+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}