CVE-2026-85678 is a stored Cross-Site Scripting (XSS) vulnerability in the AI Builder WordPress plugin prior to version 2.7.8. The flaw arises because the plugin does not sanitize custom JavaScript associated with posts before echoing it inside a script tag on the front end. This enables users with contributor or higher privileges to inject malicious JavaScript code that executes in the context of users viewing the affected post, potentially leading to session hijacking, privilege escalation, or other client-side attacks.

The vulnerability allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript that executes in the browsers of other users who view the affected post, including administrators and editors. This can lead to compromise of user sessions, unauthorized actions performed on behalf of users, or other malicious client-side effects. The impact is limited to users who can create or edit posts and those who view them.

Upgrade the AI Builder WordPress plugin to version 2.7.8 or later, where this vulnerability is fixed. Users should apply this official fix to prevent exploitation. Until upgraded, restrict contributor-level access to trusted users only.