CVE-2026-100107

HighCVSS 7.2/10Last modified Oct 3, 2026

Description

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 2, 2026
Last modified
Oct 3, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1001086.4The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter iCVE-2026-100113.1Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proCVE-2026-1001117.8Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cuCVE-2026-1001127.8Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cuCVE-2026-1001137.5CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attackeCVE-2026-1001147.5CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker CVE-2026-1001157.5CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker CVE-2026-1001165.9CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An aCVE-2026-1001177.5CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attackeCVE-2026-1001187.5CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An aCVE-2026-1001197.5CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attackeCVE-2026-100128.3Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potent
CVE-2026-100107: High severity, CVSS 7.2 | Vulnix