The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link… (CVE-2026-88782)
The Kubio AI Page Builder WordPress plugin versions before 2.9.3 contain a vulnerability where the plugin does not validate the URI scheme of user-supplied input before rendering it as a link target. This flaw allows users with contributor or higher roles to inject payloads that execute in the browser of anyone who clicks the link, including administrators previewing unpublished content.
AI Analysis
Technical Summary
The Kubio AI Page Builder WordPress plugin prior to version 2.9.3 fails to validate the URI scheme of a user-supplied value before outputting it as a link target. This improper validation enables users with contributor-level permissions or higher to store malicious payloads that execute in the browser context of users who follow the crafted link. This includes administrators who preview unpublished submissions, potentially leading to cross-site scripting (XSS) attacks.
Potential Impact
Users with contributor or higher privileges can inject malicious links that execute scripts in the browsers of users who click them, including administrators. This can lead to unauthorized actions performed in the context of the victim's session, potentially compromising site integrity or user data.
Mitigation Recommendations
Upgrade the Kubio AI Page Builder WordPress plugin to version 2.9.3 or later, where the URI scheme validation issue has been addressed. No other mitigation steps are indicated.
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link… (CVE-2026-88782)
Description
The Kubio AI Page Builder WordPress plugin versions before 2.9.3 contain a vulnerability where the plugin does not validate the URI scheme of user-supplied input before rendering it as a link target. This flaw allows users with contributor or higher roles to inject payloads that execute in the browser of anyone who clicks the link, including administrators previewing unpublished content.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Kubio AI Page Builder WordPress plugin prior to version 2.9.3 fails to validate the URI scheme of a user-supplied value before outputting it as a link target. This improper validation enables users with contributor-level permissions or higher to store malicious payloads that execute in the browser context of users who follow the crafted link. This includes administrators who preview unpublished submissions, potentially leading to cross-site scripting (XSS) attacks.
Potential Impact
Users with contributor or higher privileges can inject malicious links that execute scripts in the browsers of users who click them, including administrators. This can lead to unauthorized actions performed in the context of the victim's session, potentially compromising site integrity or user data.
Mitigation Recommendations
Upgrade the Kubio AI Page Builder WordPress plugin to version 2.9.3 or later, where the URI scheme validation issue has been addressed. No other mitigation steps are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-gf46-mg37-6fp9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-88782"]
- State
- PUBLISHED
Threat ID: 6ac13992a43b0b3b89d699a2
Added to database: 10/03/2026, 17:21:22 UTC
Last enriched: 10/03/2026, 17:34:18 UTC
Last updated: 10/04/2026, 02:46:07 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.