The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an administrator previewing the unpublished submission.

cve CVE-2026-88782 2 sources, 2 claims · Watch

NVD writes:
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an administrator previewing the unpublished submission. the claim

What it is to other things

In words only, so not counted until a person confirms one:

affectsunknown/kubio_ai_page_builder
NVD says “Unknown · Kubio AI Page Builder”
made_byunknown
NVD says “Unknown”

What each source says

PropertySourceSaidMeans here
Cvss
cvss
GitHub advisories6.8
receipt
Source
GitHub advisories
Its words
6.8
Read by
field:cvss.score
Said since
2026-10-04 00:09 UTC
Last answered
2026-10-04 12:14 UTC
Original
open at the source
2026-10-04 00:09 UTC6.8
2026-10-03 12:05 UTC—
What the source handed over
{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-88782",
  "cvss": {
    "score": 6.8,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 6.8,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-79",
      "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
    }
  ],
  "description": "The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an administrator previewing the unpublished submission.",
  "ghsa_id": "GHSA-gf46-mg37-6fp9",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-gf46-mg37-6fp9",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-gf46-mg37-6fp9"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-88782"
    }
  ],
  "nvd_published_at": "2026-10-03T06:16:44Z",
  "published_at": "2026-10-03T06:31:13Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-88782",
    "https://wpscan.com/vulnerability/b45063f1-65a0-44cb-9565-0242f30fd7a3",
    "https://github.com/advisories/GHSA-gf46-mg37-6fp9"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a...",
  "type": "unreviewed",
  "updated_at": "2026-10-03T18:32:05Z",
  "url": "https://api.github.com/advisories/GHSA-gf46-mg37-6fp9",
  "vulnerabilities": [],
  "withdrawn_at": null
}
—
Cvss
cvss
NVD6.8
receipt
Source
NVD
Its words
6.8
Read by
field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since
2026-10-03 18:10 UTC
Last answered
2026-10-04 12:15 UTC
Original
open at the source
2026-10-03 18:10 UTC6.8
2026-10-03 12:09 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Kubio AI Page Builder",
            "vendor": "Unknown",
            "versions": [
              {
                "lessThan": "2.9.3",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "contact@wpscan.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an administrator previewing the unpublished submission."
      }
    ],
    "id": "CVE-2026-88782",
    "lastModified": "2026-10-03T16:16:40.277",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 0.9,
          "impactScore": 5.9,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-88782",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-10-03T15:01:30.605310Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-10-03T06:16:44.740",
    "references": [
      {
        "source": "contact@wpscan.com",
        "url": "https://wpscan.com/vulnerability/b45063f1-65a0-44cb-9565-0242f30fd7a3/"
      }
    ],
    "sourceIdentifier": "contact@wpscan.com",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}
—
Cwe
cwe
GitHub advisoriesCWE-79
receipt
Source
GitHub advisories
Its words
CWE-79
Read by
field:cwes[].cwe_id
Said since
2026-10-04 00:09 UTC
Last answered
2026-10-04 12:14 UTC
Original
open at the source
2026-10-04 00:09 UTCCWE-79
2026-10-03 12:05 UTC—
What the source handed over
{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-88782",
  "cvss": {
    "score": 6.8,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 6.8,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-79",
      "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
    }
  ],
  "description": "The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an administrator previewing the unpublished submission.",
  "ghsa_id": "GHSA-gf46-mg37-6fp9",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-gf46-mg37-6fp9",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-gf46-mg37-6fp9"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-88782"
    }
  ],
  "nvd_published_at": "2026-10-03T06:16:44Z",
  "published_at": "2026-10-03T06:31:13Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-88782",
    "https://wpscan.com/vulnerability/b45063f1-65a0-44cb-9565-0242f30fd7a3",
    "https://github.com/advisories/GHSA-gf46-mg37-6fp9"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a...",
  "type": "unreviewed",
  "updated_at": "2026-10-03T18:32:05Z",
  "url": "https://api.github.com/advisories/GHSA-gf46-mg37-6fp9",
  "vulnerabilities": [],
  "withdrawn_at": null
}
—
Product
product
NVDKubio AI Page Builder
receipt
Source
NVD
Its words
Kubio AI Page Builder
Read by
field:cve.affected[].affectedData[].product
Said since
2026-10-03 12:09 UTC
Last answered
2026-10-04 12:15 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Kubio AI Page Builder",
            "vendor": "Unknown",
            "versions": [
              {
                "lessThan": "2.9.3",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "contact@wpscan.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an administrator previewing the unpublished submission."
      }
    ],
    "id": "CVE-2026-88782",
    "lastModified": "2026-10-03T16:16:40.277",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 0.9,
          "impactScore": 5.9,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-88782",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-10-03T15:01:30.605310Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-10-03T06:16:44.740",
    "references": [
      {
        "source": "contact@wpscan.com",
        "url": "https://wpscan.com/vulnerability/b45063f1-65a0-44cb-9565-0242f30fd7a3/"
      }
    ],
    "sourceIdentifier": "contact@wpscan.com",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}
—
Severity
severity
GitHub advisoriesmedium
receipt
Source
GitHub advisories
Its words
medium
Read by
field:severity
Said since
2026-10-04 00:09 UTC
Last answered
2026-10-04 12:14 UTC
Original
open at the source
2026-10-04 00:09 UTCmedium
2026-10-03 12:05 UTCunknown
What the source handed over
{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-88782",
  "cvss": {
    "score": 6.8,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 6.8,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-79",
      "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
    }
  ],
  "description": "The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an administrator previewing the unpublished submission.",
  "ghsa_id": "GHSA-gf46-mg37-6fp9",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-gf46-mg37-6fp9",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-gf46-mg37-6fp9"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-88782"
    }
  ],
  "nvd_published_at": "2026-10-03T06:16:44Z",
  "published_at": "2026-10-03T06:31:13Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-88782",
    "https://wpscan.com/vulnerability/b45063f1-65a0-44cb-9565-0242f30fd7a3",
    "https://github.com/advisories/GHSA-gf46-mg37-6fp9"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a...",
  "type": "unreviewed",
  "updated_at": "2026-10-03T18:32:05Z",
  "url": "https://api.github.com/advisories/GHSA-gf46-mg37-6fp9",
  "vulnerabilities": [],
  "withdrawn_at": null
}
—
Status
status
NVDReceived
receipt
Source
NVD
Its words
Received
Read by
field:cve.vulnStatus
Said since
2026-10-03 12:09 UTC
Last answered
2026-10-04 12:15 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Kubio AI Page Builder",
            "vendor": "Unknown",
            "versions": [
              {
                "lessThan": "2.9.3",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "contact@wpscan.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an administrator previewing the unpublished submission."
      }
    ],
    "id": "CVE-2026-88782",
    "lastModified": "2026-10-03T16:16:40.277",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 0.9,
          "impactScore": 5.9,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-88782",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-10-03T15:01:30.605310Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-10-03T06:16:44.740",
    "references": [
      {
        "source": "contact@wpscan.com",
        "url": "https://wpscan.com/vulnerability/b45063f1-65a0-44cb-9565-0242f30fd7a3/"
      }
    ],
    "sourceIdentifier": "contact@wpscan.com",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}
—
Vendor
vendor
NVDUnknown
receipt
Source
NVD
Its words
Unknown
Read by
field:cve.affected[].affectedData[].vendor
Said since
2026-10-03 12:09 UTC
Last answered
2026-10-04 12:15 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Kubio AI Page Builder",
            "vendor": "Unknown",
            "versions": [
              {
                "lessThan": "2.9.3",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "contact@wpscan.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an administrator previewing the unpublished submission."
      }
    ],
    "id": "CVE-2026-88782",
    "lastModified": "2026-10-03T16:16:40.277",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 0.9,
          "impactScore": 5.9,
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-88782",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-10-03T15:01:30.605310Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-10-03T06:16:44.740",
    "references": [
      {
        "source": "contact@wpscan.com",
        "url": "https://wpscan.com/vulnerability/b45063f1-65a0-44cb-9565-0242f30fd7a3/"
      }
    ],
    "sourceIdentifier": "contact@wpscan.com",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  }
}
—

vulnerability

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an administrator previewing the unpublished submission.
zetlyn/cve-nvd · 2026-10-03
cvss 6.8 product Kubio AI Page Builder status Received vendor Unknown source
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a...
zetlyn/cve-ghsa · 2026-10-03
cvss 6.8 cwe CWE-79 severity medium source