CVE-2026-88783

Summary

This flaw allows unauthenticated users to inject malicious HTML, leading to Cross-Site Scripting (XSS) attacks that can execute arbitrary scripts in the context of any visitor or an administrator reviewing the content.

Exploitability

Exploitation is relatively straightforward as it requires unauthenticated user input, but the attacker must ensure the content is submitted and reviewed by an administrator or visitor.

Blast radius

The impact is high, as any visitor or administrator reviewing the content can be affected, potentially leading to data theft, session hijacking, or other malicious activities.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.9.3 or later of the Kubio AI Page Builder WordPress plugin.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.