{"id":"CVE-2026-88783","published":"2026-10-03T06:16:45.037","lastModified":"2026-10-06T15:18:12.170","description":"The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder WordPress plugin before 2.9.3's own script later executes in the browser of any visitor, or of an administrator reviewing the still-unapproved submission.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/94d11df1-dae7-479f-bc93-3db6b0925d99/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This flaw allows unauthenticated users to inject malicious HTML, leading to Cross-Site Scripting (XSS) attacks that can execute arbitrary scripts in the context of any visitor or an administrator reviewing the content.","exploitability":"Exploitation is relatively straightforward as it requires unauthenticated user input, but the attacker must ensure the content is submitted and reviewed by an administrator or visitor.","blast_radius":"The impact is high, as any visitor or administrator reviewing the content can be affected, potentially leading to data theft, session hijacking, or other malicious activities.","remediation":"Upgrade to version 2.9.3 or later of the Kubio AI Page Builder WordPress plugin.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","web","wp-plugin","unauth"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-04T08:41:22.318Z"}}