Knowledge Building WordPress Plugin: Stored Cross-Site Scripting (CVE-2026-121862)
The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against visitors and administrators.
CVE search metadata
CVE search record: CVE-2026-121862. Severity: high. CVSS: 8.8. KEV: no. Product: Knowledge Building (< 0.7.3). Brief: Knowledge Building WordPress Plugin: Stored Cross-Site Scripting (CVE-2026-121862). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-121862/
Triage facts
Revision 1- Applicability
- Knowledge Building (< 0.7.3)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 13:59 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, and publishes them without moderation. This allows unauthenticated users to perform Stored Cross-Site Scripting attacks against any visitor of the affected posts, including administrators.