The AI Builder WordPress plugin fails to sanitize custom JavaScript stored with a post, outputting it inside a script tag on the front end. This flaw allows any user with contributor level access or higher to embed arbitrary JavaScript that will execute in the browser of anyone who views the post, including editors and administrators. The injected script can potentially hijack a user’s session or steal sensitive information, thereby compromising the confidentiality and integrity of users’ data.

Any WordPress site using the AI Builder plugin with a version earlier than 2.7.8. Users with contributor or higher role privileges can exploit the issue because the plugin does not enforce stricter access controls on the custom JavaScript field.

The vulnerability’s EPSS score is < 1%, and it is not listed in CISA’s KEV catalog. The likely attack vector is privilege‑based: an authenticated contributor or higher user can create or edit a post to embed malicious script. Once a victim visits the post, the injected code runs with the victim’s browser context, providing the attacker with the ability to steal cookies, perform actions on behalf of the user, or deface pages. The vulnerability’s severity is medium, as indicated by a CVSS score of 6.8.