CVE-2026-85678: AI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScript

Q: Who can exploit this issue, and who is at risk from the payload?

A user with Contributor-level access or higher can save arbitrary JavaScript against a post. The code runs in the browser of anyone viewing that post, including editors and administrators reviewing it.

Q: Which installations are affected?

WordPress sites using AI Builder versions before 2.7.8 are affected. The provided information does not state whether any particular plugin setting must be enabled beyond the ability to save custom JavaScript against a post.

Q: What can be done while an update is not available or cannot be applied?

Restrict Contributor and higher roles to trusted users, and prevent untrusted users from creating or editing posts that can carry custom JavaScript. Review existing posts for custom JavaScript content before editors or administrators view them.

Published Sep 11, 2026

Updated

The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views the post, including the editor or administrator who reviews it.

Affected Software

1 affected component

WordPress AI Builder<2.7.8

Event History

Sep 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue, and who is at risk from the payload?

A user with Contributor-level access or higher can save arbitrary JavaScript against a post. The code runs in the browser of anyone viewing that post, including editors and administrators reviewing it.

Which installations are affected?

WordPress sites using AI Builder versions before 2.7.8 are affected. The provided information does not state whether any particular plugin setting must be enabled beyond the ability to save custom JavaScript against a post.

What can be done while an update is not available or cannot be applied?

Restrict Contributor and higher roles to trusted users, and prevent untrusted users from creating or editing posts that can carry custom JavaScript. Review existing posts for custom JavaScript content before editors or administrators view them.