CVE-2026-14472 is a stored cross-site scripting vulnerability in the Kubio AI Page Builder plugin for WordPress, affecting all versions up to and including 2.8.4. The vulnerability arises from insufficient sanitization and escaping of input in the kubio/copyright block content. Authenticated attackers with contributor or higher privileges can inject arbitrary scripts that execute in the context of users viewing the injected pages. The issue bypasses WordPress core's kses-on-save filter and the plugin's wp_kses_post() call because entity-encoded script tags are treated as inert text by kses but are subsequently decoded into executable HTML by the plugin's html_entity_decode() call in the CopyrightBlock::render_template() method.

Successful exploitation allows authenticated users with contributor-level access or higher to inject and execute arbitrary JavaScript in the context of other users viewing the affected pages. This can lead to information disclosure and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of users. The vulnerability does not impact availability.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Kubio AI Page Builder plugin if possible. Avoid granting contributor or higher privileges to untrusted users to reduce risk.