{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/knowledge-building--0.7.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-121863"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Knowledge Building (\u003c 0.7.3)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Knowledge Building WordPress plugin before 0.7.3 fails to escape user-supplied values before echoing them back in an AJAX action response served as HTML. This leads to a Reflected Cross-Site Scripting (XSS) vulnerability exploitable by unauthenticated users.\u003c/p\u003e\n","date_modified":"2026-11-11T13:59:41Z","date_published":"2026-11-11T13:59:41Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-121863/","summary":"The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoing them back in the response of an AJAX action available to unauthenticated users, leading to Reflected Cross-Site Scripting.","title":"Knowledge Building WordPress Plugin: Reflected Cross-Site Scripting (CVE-2026-121863)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-121863/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-121862"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Knowledge Building (\u003c 0.7.3)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, and publishes them without moderation. This allows unauthenticated users to perform Stored Cross-Site Scripting attacks against any visitor of the affected posts, including administrators.\u003c/p\u003e\n","date_modified":"2026-11-11T13:59:34Z","date_published":"2026-11-11T13:59:34Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-121862/","summary":"The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against visitors and administrators.","title":"Knowledge Building WordPress Plugin: Stored Cross-Site Scripting (CVE-2026-121862)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-121862/"}],"language":"en","title":"CraftedSignal Threat Feed - Knowledge Building (\u003c 0.7.3)","version":"https://jsonfeed.org/version/1.1"}