Advisories · Technology

extendthemes Kubio AI Page Builder.

Every CVE that names extendthemes Kubio AI Page Builder among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-115816 CVE record

CVSS 6.4 Medium

Kubio AI Page Builder <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via kubio/shortcode Block via Product Review
- extendthemes Kubio AI Page Builder
- Cross-site scripting (XSS)
Not analysed yet 7 Nov 2026
CVE-2026-100107 CVE record

CVSS 7.2 High

Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)
- extendthemes Kubio AI Page Builder
- Cross-site scripting (XSS)
Not analysed yet 2 Oct 2026
CVE-2026-14472 CVE record

CVSS 6.4 Medium

Kubio AI Page Builder <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content
- extendthemes Kubio AI Page Builder
- Cross-site scripting (XSS)
Not analysed yet 18 Sept 2026
CVE-2026-16779 CVE record

CVSS 4.3 Medium

Kubio AI Page Builder <= 2.8.5 - Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration Reversion via kubio_restore_front_page AJAX Action
- extendthemes Kubio AI Page Builder
- Broken access control
Not analysed yet 16 Aug 2026
CVE-2026-5427 CVE record

CVSS 5.3 Medium

Kubio AI Page Builder <= 2.7.2 - Missing Authorization to Authenticated (Contributor+) Limited File Upload via Kubio Block Attributes
- extendthemes Kubio AI Page Builder
- Broken access control
Not analysed yet 17 Apr 2026
CVE-2025-8487 CVE record

CVSS 5.4 Medium

Kubio AI Page Builder <= 2.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation
- extendthemes Kubio AI Page Builder
- Broken access control
Not analysed yet 19 Sept 2025
CVE-2025-2294 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion
- extendthemes Kubio AI Page Builder
- Path traversal
Not analysed yet 28 Mar 2025
CVE-2024-13516 CVE record

CVSS 6.1 Medium

Kubio AI Page Builder <= 2.3.5 - Reflected Cross-Site Scripting
- extendthemes Kubio AI Page Builder
- Cross-site scripting (XSS)
Not analysed yet 18 Jan 2025
CVE-2024-39661 CVE record

CVSS 6.5 Medium

WordPress Kubio AI Page Builder plugin <= 2.2.4 - Authenticated Cross Site Scripting (XSS) vulnerability
- ExtendThemes Kubio AI Page Builder
- Cross-site scripting (XSS)
Not analysed yet 1 Aug 2024