Threat database

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder kubio allows Reflected XSS.This issue affects Kubio AI Page Builder: from n/a through 2.9.3.

CVE-2026-83492 is an improper input validation vulnerability in Extend Themes Kubio AI Website Builder affecting versions before 2.9.1. The flaw relates to CWE-20, indicating that the software does not properly validate input data. The vulnerability has a CVSS 4.0 base score of 6.9, categorized as medium severity. No official patch or remediation guidance is currently available, and there are no known exploits in the wild. The product is not a cloud service, so remediation depends on vendor updates. No affected versions were explicitly stated beyond the indication that versions before 2.9.1 are impacted.

CVE-2026-78268 is a high severity vulnerability affecting Extend Themes' Lead Generation Contact Widget & AI Chatbot (versions up to and including 1.2.0). It allows unauthenticated attackers to expose sensitive system information. The vulnerability is classified under CWE-497, which involves exposure of sensitive system information to unauthorized entities. No official patch or remediation guidance is currently available from the vendor.

Cross-Site request forgery (CSRF) vulnerability in Extend Themes Skyline WP allows Cross Site Request Forgery. This issue affects Skyline WP: from n/a through 1.0.10.

CVE-2026-34887 is a medium severity vulnerability in Extend Themes Kubio AI Page Builder that allows stored cross-site scripting (XSS) due to improper neutralization of input during web page generation. This affects versions up to and including 2.7.0. The vulnerability requires at least low privileges and user interaction to exploit and can lead to partial confidentiality, integrity, and availability impacts. No patch or official fix information is currently available.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through < 1.0.334.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through <= 1.0.329.

Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes EmpowerWP.This issue affects EmpowerWP: from n/a through 1.0.21.

Missing Authorization vulnerability in Extend Themes Pathway, Extend Themes Hugo WP, Extend Themes Althea WP, Extend Themes Elevate WP, Extend Themes Brite, Extend Themes Colibri WP, Extend Themes Vertice.This issue affects Pathway: from n/a through 1.0.15; Hugo WP: from n/a through 1.0.8; Althea WP: from n/a through 1.0.13; Elevate WP: from n/a through 1.0.15; Brite: from n/a through 1.0.11; Colibri WP: from n/a through 1.0.94; Vertice: from n/a through 1.0.7.

Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Teluro.This issue affects Teluro: from n/a through 1.0.31.

Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Calliope.This issue affects Calliope: from n/a through 1.0.33.