CVE-2026-85678
MEDIUM — CVSS 6.4Authenticated (Contributor+) Stored Cross-Site Scripting (XSS) via Post JavaScript in AI Builder
Summary
A Stored Cross-Site Scripting (XSS) vulnerability exists in the WordPress AI Builder plugin in versions prior to 2.7.8. The plugin fails to properly sanitize and escape custom JavaScript saved against a post before outputting it on the front end inside an inline <script> element.
This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts that execute in the browser of any user viewing the published or previewed post.
Technical Details
AI Builder enables AI-generated layouts and page building blocks for WordPress. During post editing, the plugin permits users to associate custom script blocks. Because input validation and output encoding were insufficient, malicious script tags and raw JavaScript payloads persist in the post metadata.
When a visitor or administrator browses the target post, the browser evaluates the injected payload within the origin context of the site.
Attack vector: Authenticated Contributor post creation / metadata update containing unescaped script payloads.
Impact
- Execution of arbitrary JavaScript in visitors' and administrators' browsers
- Potential session hijacking, admin action forgery, and account compromise
- Defacement or redirection of affected WordPress posts
Remediation
Update AI Builder to version 2.7.8 or later. The patch adds strict sanitization and validation on post-level custom JavaScript and scripts execution.