CVE-2025-2294: critical vulnerability in extendthemes Kubio AI Page Builder
Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
100Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9.8epss 78%
from disclosure to weaponsame day
Published on NVDMar 28
1st PoCMar 27
VulnCheckMar 27
The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via thekubio_hybrid_theme_load_template function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
extendthemes · Kubio AI Page Builderpublic PoCs found — 19
exploitdbwww.exploit-db.com/exploits/52125unverifiedgithubgithub.com/Nxploited/CVE-2025-2294★ 3githubgithub.com/fumioryoto/CVE-2025-2294-Kubio-2.5.1-LFi-Checker★ 2githubgithub.com/Yucaerin/CVE-2025-2294★ 1githubgithub.com/mrrivaldo/CVE-2025-2294★ 0githubgithub.com/romanedutov/CVE-2025-2294★ 0githubgithub.com/rhz0d/CVE-2025-2294★ 0githubgithub.com/0xWhoami35/CVE-2025-2294★ 0githubgithub.com/r0otk3r/CVE-2025-2294★ 0githubgithub.com/iteride/CVE-2025-2294★ 0vulncheckvulncheck.com/xdb/82d3422ef03eunverifiedvulncheckvulncheck.com/xdb/85c7e160b363unverifiedvulncheckvulncheck.com/xdb/ea9966e48ae7unverifiedvulncheckvulncheck.com/xdb/d868beb11d5funverifiedvulncheckvulncheck.com/xdb/70101ee6d39dunverifiedvulncheckvulncheck.com/xdb/4f86e61902b8unverifiedvulncheckvulncheck.com/xdb/bdac246dcc8eunverifiedvulncheckvulncheck.com/xdb/21e5ad438bbeunverifiedvulncheckvulncheck.com/xdb/035b022968d1unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — extendthemes Kubio AI Page Builder
In the same product, most dangerous first.
CVE-2026-5427MEDIUMKubio AI Page Builder <= 2.7.2 - Missing Authorization to Authenticated (Contributor+) Limited File Upload via Kubio Block AttributesEPSS 0.5%CVE-2026-16779MEDIUMKubio AI Page Builder <= 2.8.5 - Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration Reversion via kubio_restore_front_page AJAX ActionEPSS 0.4%CVE-2026-14472MEDIUMKubio AI Page Builder <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block ContentEPSS 0.4%CVE-2026-100107HIGHKubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)EPSS 0.3%CVE-2024-13516MEDIUMKubio AI Page Builder <= 2.3.5 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-8487MEDIUMKubio AI Page Builder <= 2.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin InstallationEPSS 0.3%