CVE-2026-100107 in Kubio AI Page Builder Plugin
Summary
by MITRE • 10/02/2026
The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/02/2026
The Kubio AI Page Builder plugin for WordPress contains a critical security vulnerability classified as Stored Cross-Site Scripting, specifically identified under CWE-79 within the Common Weakness Enumeration framework. This flaw resides in the handling of the comment parameter across all versions up to and including 2.9.2. The root cause is insufficient input sanitization combined with inadequate output escaping during the processing of user-supplied data. Unlike reflected XSS where malicious scripts are executed immediately via a crafted link, stored vulnerabilities persist by saving the injected payload into the application's database or persistent storage mechanism. Consequently, every time an administrator or authorized user loads the affected page containing this compromised comment, the browser interprets and executes the embedded JavaScript code as part of the legitimate web content.
From an operational perspective, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts without requiring any form of authentication or prior access credentials. This lack of a prerequisite authentication step significantly lowers the barrier for exploitation, enabling even novice threat actors to compromise the integrity and confidentiality of the WordPress environment. The impact extends beyond simple script execution; it facilitates session hijacking through cookie theft, allowing attackers to impersonate legitimate users such as site administrators. Furthermore, stored XSS can be leveraged to deface websites by altering displayed content or redirecting visitors to malicious phishing sites designed to harvest sensitive information like login credentials and financial data.
The attack vector aligns with the ATT&CK technique of Client-side Injection (T1059), specifically focusing on JavaScript execution within a web browser context. The persistence mechanism corresponds to Persistence via Web Shell or similar storage-based methods where the malicious payload remains active until manually removed from the database. This creates a long-term risk as the vulnerability does not require repeated exploitation attempts; once injected, it affects all subsequent visitors who view the compromised page.
To mitigate this vulnerability, immediate action is required by upgrading the Kubio AI Page Builder plugin to version 2.9.3 or later where these sanitization and escaping issues have been addressed. Administrators should also implement strict Content Security Policy headers to restrict the execution of inline scripts, thereby reducing the impact even if similar vulnerabilities exist in other plugins. Regular security audits and code reviews focusing on input validation and output encoding practices are essential for maintaining a secure WordPress ecosystem. Additionally, deploying Web Application Firewalls can provide an additional layer of defense by filtering out malicious payloads before they reach the application logic or database storage layers.