The vulnerability CVE-2026-34887 in Extend Themes Kubio AI Page Builder is a stored cross-site scripting (CWE-79) issue caused by improper input neutralization during web page generation. It affects versions through 2.7.0 and allows an attacker with low privileges and requiring user interaction to execute malicious scripts in a way that compromises confidentiality, integrity, and availability to a limited extent. The CVSS 3.1 base score is 6.5, reflecting a medium severity level with network attack vector, low attack complexity, and scope change.

Successful exploitation of this stored XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. Because it is stored XSS, malicious scripts can persist and execute in the context of other users, potentially leading to session hijacking, defacement, or other malicious actions. However, the impact is limited by the requirement for low privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a patch is released, users should exercise caution with untrusted input and consider applying temporary mitigations such as input validation or disabling vulnerable features if possible.