The Knowledge Base plugin for WordPress is vulnerable to stored cross‑site scripting because the plugin slug input is not properly sanitized or escaped when saved. An administrator who modifies the slug can embed malicious JavaScript that will be rendered in any page that includes the slug. When a regular user visits that page, the script runs in the user’s browser, allowing the attacker to steal session cookies, deface or redirect the site, or conduct phishing attacks. The vulnerability is limited to authenticated attackers with administrator privileges and requires the site to be a multi‑site installation with the unfiltered_html capability disabled.

Affected systems are installations of the Knowledge Base plugin for WordPress version 2.3.1 or earlier, deployed in WordPress multisite environments with the unfiltered_html filter disabled. The plugin is distributed by the vendor Ajay. Any site that has upgraded to 2.3.1 or earlier remains vulnerable; newer releases are assumed to have remedied the issue.

The CVSS base score of 4.4 indicates a low‑to‑medium severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that an attacker already holds administrator privileges; the attack vector is local via authenticated access, so the main risk is upward privilege use among trusted users. Once the slug is tampered with, the stored payload will affect all visitors to the affected page, making this a significant concern for sites with unfiltered_html disabled.