Threats tagged 'ghsa-c4vj-h9mj-xv36'

The Kubio AI Page Builder plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment (review body)' parameter in all versions up to and including 2.9.4. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. Exploitation requires the attacker's review containing the payload to be approved, either automatically or manually, and the active single-product template must use a Kubio-rendered wp:post-content block.