What is GHSA-gf46-mg37-6fp9?

GHSA-gf46-mg37-6fp9 is a security advisory published by GitHub Security Advisories with Medium severity. The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a...

Which CVE IDs does GHSA-gf46-mg37-6fp9 cover?

GHSA-gf46-mg37-6fp9 covers the following CVE IDs: CVE-2026-88782. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gf46-mg37-6fp9?

GHSA-gf46-mg37-6fp9 has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-gf46-mg37-6fp9MediumCVSS 6.8

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a...

Vendor

GitHub Security Advisories

Published

October 3, 2026

Last Modified

October 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-88782 →

📋 Description

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an administrator previewing the unpublished submission.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-88782
https://wpscan.com/vulnerability/b45063f1-65a0-44cb-9565-0242f30fd7a3
https://github.com/advisories/GHSA-gf46-mg37-6fp9