CVE-2024-13516: Kubio AI Page Builder XSS Vulnerability

CVE-2024-13516 Overview

CVE-2024-13516 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Kubio AI Page Builder plugin for WordPress. The flaw affects all versions up to and including 2.3.5. It stems from insufficient input sanitization and output escaping on the message parameter processed by the kubio-iframe-loader.html static asset. Unauthenticated attackers can craft a malicious link that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser under the vulnerable site's origin. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser session, enabling session token theft, forced administrative actions, and site defacement when an authenticated administrator is tricked into visiting a crafted URL.

Affected Products

Kubio AI Page Builder plugin for WordPress — all versions through 2.3.5
WordPress sites with the vulnerable plugin installed and activated
Any site where an authenticated user can be enticed to click an attacker-crafted URL

Discovery Timeline

2025-01-18 - CVE-2024-13516 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13516

Vulnerability Analysis

The vulnerability resides in the plugin's iframe loader component, specifically static/kubio-iframe-loader.html. The loader reads the message query parameter from the request URL and reflects its value into the rendered HTML response without applying context-appropriate output escaping.

Because the reflected data is inserted into a browser-executable context, an attacker can supply HTML or JavaScript payloads within the message value. When a victim requests the crafted URL, the browser parses the injected markup and executes attacker-controlled script under the site's origin.

Exploitation requires user interaction, such as clicking a phishing link or visiting an attacker-controlled page that triggers navigation to the vulnerable endpoint. No authentication is required to trigger the injection.

Root Cause

The root cause is missing input sanitization and missing output escaping on the message parameter within kubio-iframe-loader.html. Reflected user input is emitted directly into the HTML response, allowing script injection [CWE-79]. Remediation was applied in the WordPress plugin repository under changeset 3186251.

Attack Vector

The attack proceeds over the network and requires no privileges, but does require victim interaction. An attacker crafts a URL pointing to the vulnerable kubio-iframe-loader.html endpoint with a malicious payload in the message query string. The attacker then delivers the link via phishing email, social media, forum comments, or a redirect from an attacker-controlled site. When a user visits the link, the injected script executes in the browser under the vulnerable WordPress site's origin, exposing cookies, DOM state, and any privileged actions the victim can perform.

The scope is changed under the CVSS model because a reflected XSS payload delivered by the plugin can affect resources beyond the vulnerable component itself, including the parent WordPress administrative context. Refer to the Wordfence advisory for additional technical details.

Detection Methods for CVE-2024-13516

Indicators of Compromise

Web server access logs containing requests to /wp-content/plugins/kubio/static/kubio-iframe-loader.html with a message parameter that includes <script, onerror=, javascript:, or URL-encoded equivalents such as %3Cscript.
Referrer headers on requests to the loader endpoint originating from external domains, social media, or link shorteners.
Unexpected outbound requests from administrator browsers to third-party domains shortly after visiting a Kubio-generated URL.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag message parameter values containing HTML tags, event handlers, or script-like tokens on any URI ending in kubio-iframe-loader.html.
Correlate reflected XSS patterns against outbound HTTP traffic from privileged user endpoints to identify successful exploitation.
Hunt for anomalous administrator sessions initiating plugin installs, user creation, or option changes shortly after visiting an external link.

Monitoring Recommendations

Enable verbose HTTP request logging on the WordPress reverse proxy and retain logs long enough to support incident response.
Monitor for spikes in traffic to Kubio plugin static assets, especially from unauthenticated referrers.
Alert on Content Security Policy (CSP) violation reports referencing inline script execution on pages served by the plugin.

How to Mitigate CVE-2024-13516

Immediate Actions Required

Upgrade the Kubio AI Page Builder plugin to a version released after 2.3.5 that includes changeset 3186251.
If immediate patching is not possible, deactivate and remove the Kubio plugin until the fix can be applied.
Rotate WordPress administrator sessions and force password resets for privileged accounts if suspicious activity is observed.

Patch Information

The vendor addressed the vulnerability in the WordPress plugin repository via changeset 3186251, which modifies static/kubio-iframe-loader.html to properly sanitize and escape the message parameter. Site administrators should install the fixed release through the WordPress plugin update mechanism and verify that the plugin version reported in the admin dashboard is greater than 2.3.5.

Workarounds

Block requests to /wp-content/plugins/kubio/static/kubio-iframe-loader.html at the WAF or reverse proxy layer when a message query parameter is present.
Deploy a restrictive Content Security Policy that disallows inline scripts and untrusted script sources on WordPress admin pages.
Train administrators to avoid clicking untrusted links pointing to their own WordPress site, particularly those containing encoded query strings.