Knowledge Building WordPress Plugin: Reflected Cross-Site Scripting (CVE-2026-121863)
The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoing them back in the response of an AJAX action available to unauthenticated users, leading to Reflected Cross-Site Scripting.
CVE search metadata
CVE search record: CVE-2026-121863. Severity: high. CVSS: 7.1. KEV: no. Product: Knowledge Building (< 0.7.3). Brief: Knowledge Building WordPress Plugin: Reflected Cross-Site Scripting (CVE-2026-121863). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-121863/
Triage facts
Revision 1- Applicability
- Knowledge Building (< 0.7.3)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 13:59 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Knowledge Building WordPress plugin before 0.7.3 fails to escape user-supplied values before echoing them back in an AJAX action response served as HTML. This leads to a Reflected Cross-Site Scripting (XSS) vulnerability exploitable by unauthenticated users.