CVE-2026-14472

Name of the Vulnerable Software and Affected Versions Kubio AI Page Builder versions prior to 2.8.5

Description Stored Cross-Site Scripting occurs via the kubio/copyright Block Content due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts execute when a user visits the affected page. The issue arises because entity-encoded script tags bypass the WordPress core kses-on-save filter and the wp kses post() call, as they are later decoded into live HTML by the html entity decode() function within CopyrightBlock::render template().

Recommendations Update to version 2.8.5 or later.