CVE-2026-88783— Kubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment Content
Quick assessment
Affected
Unknown Kubio AI Page Builder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Kubio AI Page Builder（一款 WordPress 插件）在 2.9.3 版本之前，未将其允许扩展的 HTML 元素范围限制在编辑器上下文中。因此，当过滤由未认证用户提交的内容时，也会应用更广泛的 HTML 元素白名单。这导致攻击者可以存储恶意标记，随后由 Kubio AI Page Builder 插件自身的脚本在任何访问者的浏览器中，或在管理员审查尚未批准的提交时执行，从而引发跨站脚本（XSS）漏洞。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-88783
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment Content
Source: CVE Program / CVE List V5
Vulnerability Description
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder WordPress plugin before 2.9.3's own script later executes in the browser of any visitor, or of an administrator reviewing the still-unapproved submission.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Kubio AI Page Builder | 0 ~ 2.9.3 | - |
|
II. Public POCs for CVE-2026-88783
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-88783
请登录查看更多情报信息。
Other References for CVE-2026-88783 (1)
-
https://wpscan.com/vulnerability/94d11df1-dae7-479f-bc93-3db6b0925d99/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-10-03 · 21 CVEs total
| CVE-2026-86832 | MetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST API | |
| CVE-2026-101159 | WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submission | |
| CVE-2026-101160 | WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review Rating | |
| CVE-2026-80518 | WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable | |
| CVE-2026-80517 | WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload | |
| CVE-2026-101161 | WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews | |
| CVE-2026-101162 | WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings | |
| CVE-2026-103293 | MPG < 4.2.3 - Editor+ Arbitrary File Read via Project Import | |
| CVE-2026-103514 | WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay | |
| CVE-2026-86834 | MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integratio | |
| CVE-2026-94238 | Loco Translate < 2.8.9 - Translator+ Limited File Read via 'path' Parameter | |
| CVE-2026-85015 | Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Tr | |
| CVE-2026-85568 | Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQLi via 'ucs' Paramet | |
| CVE-2026-91078 | TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN | |
| CVE-2026-88782 | Kubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL Attribu | |
| CVE-2026-92437 | Mailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and Deletion | |
| CVE-2026-89236 | SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sort_column' and 'sort_order' Par | |
| CVE-2026-96962 | Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code | |
| CVE-2026-92923 | Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscriber+ SQLi via get_addon_output_ | |
| CVE-2026-94239 | Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle Configuration |
IV. Related Vulnerabilities
Same product: Kubio AI Page Builder
-
CVE-2026-88782
Kubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via -
CVE-2026-100107
Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cros -
CVE-2026-14472
Kubio AI Page Builder <= 2.8.4 - Authenticated (Contributor+ -
CVE-2026-16779
Kubio AI Page Builder <= 2.8.5 - Missing Authorization to Au -
CVE-2026-5427
Kubio AI Page Builder <= 2.7.2 - Missing Authorization to Au
Same vendor: Unknown
-
CVE-2026-94238
Loco Translate < 2.8.9 - Translator+ Limited File Read via ' -
CVE-2026-94239
Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle C -
CVE-2026-92923
Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscrib -
CVE-2026-96962
Pie Register < 3.8.4.14 - Unauthenticated User Email Disclos -
CVE-2026-89236
SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sor
V. Comments for CVE-2026-88783
No comments yet