CVE-2026-88782 Kubio CVE debrief

Who should care

Defenders responsible for WordPress environments with the Kubio AI Page Builder plugin installed should assess exposure and prioritize verification and remediation due to the risk of stored payload execution in browsers of users who follow the link, including potential administrator compromise when previewing unpublished submissions.

Why it matters

The Kubio AI Page Builder WordPress plugin vulnerability allows for stored payload execution, posing a risk to WordPress environments with the plugin installed. Defenders should prioritize verification and remediation.

• Execution of stored payload in browsers of users who follow the link
• Potential for administrator compromise when previewing unpublished submissions
• Verification of plugin version and exposure is necessary

Technical summary

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an administrator previewing the unpublished submission. This vulnerability allows for stored payload execution in the browser, posing a risk to WordPress environments with the plugin installed. Defenders should prioritize verifying the plugin version and assessing exposure.

Defensive priority

Defenders should prioritize verifying the plugin version and assessing exposure, as the vulnerability allows for stored payload execution in the browser.

Recommended defensive actions

• Verify the Kubio AI Page Builder plugin version and update to 2.9.3 or later if necessary
• Assess exposure of the plugin in the WordPress environment
• Monitor for suspicious activity related to the plugin
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being a WordPress plugin vulnerability report from WPScan. Additional verification is needed to confirm affected scope and severity. Defenders should review the official advisory and CVE record to validate exposure and prioritize remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.