Description
The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, and publishes them without moderation, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against any visitor of the affected posts, including administrators.
Published:
2026-11-11
Score:
n/a
EPSS:
n/a
KEV:
No
Impact:
n/a
Action:
n/a
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | Knowledge Building | unaffected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
History
Wed, 11 Nov 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, and publishes them without moderation, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against any visitor of the affected posts, including administrators. | |
| Title | Knowledge Building < 0.7.3 - Unauthenticated Stored XSS via knbu_new_reply AJAX Action | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-11-11T06:00:11.309Z
Reserved: 2026-11-04T09:44:43.979Z
Link: CVE-2026-121862
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-11T06:17:16.710
Modified: 2026-11-11T06:17:16.710
Link: CVE-2026-121862
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.