Kubio AI Page Builder <= 2.9.4 - Unauthenticated Arbitrary Shortcode Execution via WooCommerce Product Reviews
- ID
- WPSEC-2026-1921
- Plugin
- Kubio AI Page Builder (kubio)
- Affected
- all versions before 2.9.5
- Remediation
- Update to 2.9.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-94
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-29
- Attack surface
- Kubio AI Page Builder on WPSec AttackSurface
- Fix released
- Published
Description
The Kubio AI Page Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution and block injection via WooCommerce product reviews in all versions up to, and including, 2.9.4, due to the plugin's WooCommerce template integration inserting the rendered single-product HTML, which includes user-supplied review text, directly into the block template source before WordPress runs do_shortcode() and the block parser over it. This makes it possible for unauthenticated attackers who can post a product review to embed shortcodes or block delimiters that are executed when the product page is rendered, which can lead to arbitrary shortcode execution or stored cross-site scripting. Exploitation requires WooCommerce with Kubio's WooCommerce template support active, and the review must be published.
References
- https://wpsec.com/vuln/WPSEC-2026-1921/
- https://plugins.svn.wordpress.org/kubio/tags/2.9.5/
- https://wordpress.org/plugins/kubio/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS