CVE-2026-85678 AI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScript

The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views t...

CVE-2026-85678

The AI Builder WordPress plugin (versions 2.4.1 through 2.7.7 ) contains a stored cross-site scripting (XSS) vulnerability. Custom JavaScript saved against a post is not sanitised before being echoed inside a [removed] tag on the front end. Users with Contributor level access or above can inject ...