Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-100107 · Microsoft / collected KEV context

cve-program · CVE-2026-100107

• https://www.wordfence.com/threat-intel/vulnerabilities/id/91e44955-d01c-4e81-89bf-35f27b8cda43?source=cve
• https://plugins.trac.wordpress.org/browser/kubio/tags/2.9.1/lib/filters/svg-kses.php#L74
• https://plugins.trac.wordpress.org/browser/kubio/tags/2.9.1/lib/filters/svg-kses.php#L80
• https://plugins.trac.wordpress.org/browser/kubio/tags/2.9.1/lib/admin-pages/pages.php#L195
• https://plugins.trac.wordpress.org/browser/kubio/tags/2.9.1/lib/frontend.php#L11
• https://plugins.trac.wordpress.org/browser/kubio/tags/2.9.1/build/frontend/index.js
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3720531%40kubio&new=3720531%40kubio

No related operational record is retained in the current change model.