The vulnerability is a reflected cross‑site scripting flaw in the Kubio AI Page Builder plugin. The description states that user input is not properly neutralized during page rendering, allowing an attacker to inject malicious JavaScript that executes in the browser of anyone who visits a crafted page. While the description does not explicitly mention any impact on server authentication or data, it is inferred that the flaw is limited to client‑side execution and does not directly compromise server state.

The issue affects all releases of the Extend Themes Kubio AI Page Builder plugin up to and including version 2.9.3. Administrators should verify the installed plugin version and ensure no older or affected version remains active on their WordPress site.

The CVSS score of 7.1 categorizes this as a high severity vulnerability. The EPSS score is unavailable and the flaw is not listed in the CISA KEV catalog, indicating no documented widespread exploitation. The description indicates a reflected XSS flaw; therefore, triggering it requires a victim to load a crafted page or submit a malicious form. This is inferred to be a client‑side attack that does not alter the server state.