CVE-2026-14472 extendthemes CVE debrief

Who should care

WordPress administrators and users with contributor-level access and above should verify and remediate vulnerable plugin versions. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Additionally, they should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-14472 allows authenticated attackers to inject web scripts, impacting users accessing injected pages. WordPress administrators and users with contributor-level access should verify and remediate vulnerable plugin versions.

• Attackers can inject arbitrary web scripts in pages
• Scripts execute when users access injected pages
• Bypasses WordPress core kses-on-save filter and plugin's wp_kses_post() call

Technical summary

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kubio/copyright Block Content in all versions up to, and including, 2.8.4. The vulnerability is caused by insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access to inject arbitrary web scripts. These scripts execute when users access injected pages, bypassing WordPress core kses-on-save filter and the plugin's own wp_kses_post() call due to entity-encoded script tags being decoded into live HTML.

Defensive priority

Remediate vulnerable plugin versions

Recommended defensive actions

• Remediate vulnerable plugin versions
• Verify plugin version 2.8.4 or earlier is not in use
• Restrict contributor-level access and above
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible due to insufficient input sanitization and output escaping in the Kubio AI Page Builder plugin for WordPress. The plugin's rendering process decodes entity-encoded script tags into live HTML, making the injected scripts executable.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.