CVE-2026-14472: Kubio AI Page Builder XSS Vulnerability

CVE-2026-14472 Overview

The Kubio AI Page Builder plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the kubio/copyright block. The flaw affects all versions up to and including 2.8.4. Authenticated users with contributor-level access or higher can inject arbitrary web scripts into pages. The scripts execute when any user views the affected page. The issue stems from insufficient input sanitization combined with post-sanitization entity decoding that reactivates encoded script content [CWE-79].

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in the context of every visitor, enabling session theft, account takeover of higher-privileged users, and site defacement.

Affected Products

Kubio AI Page Builder plugin for WordPress
All versions up to and including 2.8.4
Installations exposing the kubio/copyright block to contributor-level or higher accounts

Discovery Timeline

2026-09-18 - CVE-2026-14472 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-14472

Vulnerability Analysis

The vulnerability resides in the Kubio copyright block's server-side render path. WordPress applies its core kses-on-save filter, and the plugin additionally invokes wp_kses_post() on block attributes. Both filters treat entity-encoded script tags (for example <script>) as inert text, so encoded payloads survive sanitization untouched.

The flaw activates when CopyrightBlock::render_template() calls html_entity_decode() on the previously sanitized content. The decode step converts the inert entity-encoded markup back into live HTML before it is emitted to the page. As a result, the sanitization filters are effectively bypassed, and the injected <script> tag executes in every visitor's browser.

Because the affected block is available to contributor-level accounts, exploitation only requires a low-privileged authenticated user. The scope is changed (S:C) since the injected script executes in the context of any user viewing the rendered post, including administrators.

Root Cause

The root cause is an order-of-operations flaw in output handling. Sanitization runs before entity decoding, so encoded HTML that appears harmless to wp_kses_post() is revived into executable markup by the subsequent html_entity_decode() call inside the block's render function.

Attack Vector

An authenticated attacker creates or edits a post containing a Kubio copyright block. The attacker supplies block content with entity-encoded script tags (for example, <script>alert(1)</script>). Sanitization allows the encoded string through, and rendering decodes it into active JavaScript. When an editor, administrator, or site visitor loads the page, the payload executes in their browser session. Refer to the Wordfence Vulnerability Report and the WordPress Kubio Copyright Block Code for the affected render path.

Detection Methods for CVE-2026-14472

Indicators of Compromise

Post or page content stored in wp_posts containing entity-encoded HTML sequences such as <script, <script, or <img followed by onerror= inside Kubio block markup.
Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages that include the kubio/copyright block.
New or modified administrator accounts, plugin installations, or option changes correlated with contributor account activity.

Detection Strategies

Query the WordPress database for post content containing wp:kubio/copyright blocks with entity-encoded HTML tags in attributes or inner content.
Enable and review WordPress audit logs for post edits performed by contributor and author accounts targeting pages that use Kubio blocks.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script executions originating from rendered post content.

Monitoring Recommendations

Alert on authenticated session anomalies for administrator accounts, including cookie theft indicators and impossible-travel logins.
Monitor web server access logs for unusual POST requests to /wp-admin/post.php and /wp-json/wp/v2/pages from contributor-role users.
Track plugin file integrity for kubio directory changes and confirm the installed version against the fixed release.

How to Mitigate CVE-2026-14472

Immediate Actions Required

Update the Kubio AI Page Builder plugin to a version later than 2.8.4 as soon as the vendor releases a patched build.
Audit all contributor, author, and editor accounts and remove or reset any that are unnecessary or untrusted.
Review pages and posts containing the kubio/copyright block and remove content that includes entity-encoded HTML.

Patch Information

The Kubio team pushed a code change in the plugin repository that addresses the sanitization order in CopyrightBlock::render_template(). Review the WordPress Kubio Changeset History and the WordPress Kubio BlockBase Class Code to confirm the fixed version and validate the applied changes.

Workarounds

Temporarily disable the Kubio AI Page Builder plugin until the site is updated to a fixed release.
Restrict the edit_posts capability so only trusted roles can author content containing Kubio blocks.
Apply a Web Application Firewall (WAF) rule that blocks POST bodies containing entity-encoded <script> sequences targeting Kubio block endpoints.

bash

# Configuration example: identify posts containing suspicious encoded script content
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content LIKE '%wp:kubio/copyright%' \
  AND (post_content LIKE '%<script%' OR post_content LIKE '%<script%');"