The AI Builder WordPress plugin fails to sanitize custom JavaScript that is stored with a post, outputting it inside a script tag on the front end. This flaw allows a user with contributor privileges or higher to inject arbitrary JavaScript that will execute in the browser of anyone who views the post, including editors or administrators. The attacker can hijack the victim’s session, spread malware, or perform phishing attacks, threatening the confidentiality, integrity, and availability of the website’s user data.

Any WordPress site using the AI Builder plugin with a version earlier than 2.7.8. In particular, users with contributor or higher role privileges can exploit the issue because the plugin does not enforce stricter access controls on the custom JavaScript field.

No EPSS score is available for this vulnerability, and it is not listed in CISA’s KEV catalog. The attack vector is privilege‑based: an authenticated contributor or higher user can create or edit a post to embed malicious script. Once a victim visits the post, the injected code runs with the victim’s browser context, providing the attacker with the ability to steal cookies, perform actions on behalf of the user, or deface pages. The vulnerability’s severity is high, as it grants cross‑site scripting without additional prerequisites beyond legitimate contributor access.