# Kubio AI Page Builder <= 2.9.4 - Unauthenticated Arbitrary Shortcode Execution via WooCommerce Product Reviews

- **ID:** WPSEC-2026-1921
- **Plugin:** Kubio AI Page Builder (`kubio`), https://wordpress.org/plugins/kubio/
- **Affected versions:** all versions before 2.9.5
- **Fixed in:** 2.9.5 (Update to 2.9.5 or later.)
- **Severity:** High 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/kubio
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1921/

## Description

The Kubio AI Page Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution and block injection via WooCommerce product reviews in all versions up to, and including, 2.9.4, due to the plugin's WooCommerce template integration inserting the rendered single-product HTML, which includes user-supplied review text, directly into the block template source before WordPress runs do_shortcode() and the block parser over it. This makes it possible for unauthenticated attackers who can post a product review to embed shortcodes or block delimiters that are executed when the product page is rendered, which can lead to arbitrary shortcode execution or stored cross-site scripting. Exploitation requires WooCommerce with Kubio's WooCommerce template support active, and the review must be published.

## References

- https://wpsec.com/vuln/WPSEC-2026-1921/
- https://plugins.svn.wordpress.org/kubio/tags/2.9.5/
- https://wordpress.org/plugins/kubio/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1921/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.