CVE-2026-94167

HighCVSS 7.1/10Last modified Oct 9, 2026

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder kubio allows Reflected XSS.This issue affects Kubio AI Page Builder: from n/a through 2.9.3.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 9, 2026
Last modified: Oct 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-941686.5Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.CVE-2026-9416910.0Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue a CVE-2026-94174.3A vulnerability was detected in code-projects Employee Management System 1.0. Affected is an unknown function of the file /myprofileup.php. CVE-2026-941707.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Sassy Social Share sas CVE-2026-941717.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency al CVE-2026-941735.4Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.CVE-2026-941747.6Administrator SQL Injection in Email Log <= 2.63 versions.CVE-2026-941767.1Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.CVE-2026-941778.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allow CVE-2026-941787.5Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.CVE-2026-941797.1Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.CVE-2026-94184.3A flaw has been found in code-projects Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the fil