CVE-2026-88782

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not check the URI scheme of a user-supplied value before writing it out as a link target. A user with the contributor role or higher can store a malicious link in content that later runs in the browser of anyone who follows it, including an administrator who previews an unpublished submission. That can expose the victim’s browser session, including an administrator’s, to script execution in the site’s origin. WordPress sites running an affected version of this plugin are impacted; the attacker must already have at least contributor access. No public proof of concept is known, the issue is not listed in CISA KEV, and it has not yet received a CVSS score; a headline about Citrix NetScaler exploitation is unrelated.

What to do: Update the Kubio AI Page Builder plugin to version 2.9.3 or later on every WordPress site that uses it. Until the update is applied, restrict the contributor role and above, and have administrators avoid previewing or following links in unpublished submissions from lower-privileged users.