https://feed.craftedsignal.io/products/knowledge-building--0.7.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 13:59:41 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-121863/Wed, 11 Nov 2026 13:59:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-121863/The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoing them back in the response of an AJAX action available to unauthenticated users, leading to Reflected Cross-Site Scripting.<p>The Knowledge Building WordPress plugin before 0.7.3 fails to escape user-supplied values before echoing them back in an AJAX action response served as HTML. This leads to a Reflected Cross-Site Scripting (XSS) vulnerability exploitable by unauthenticated users.</p> highadvisoryhttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-121862/Wed, 11 Nov 2026 13:59:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-121862/The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against visitors and administrators.<p>The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, and publishes them without moderation. This allows unauthenticated users to perform Stored Cross-Site Scripting attacks against any visitor of the affected posts, including administrators.</p> highadvisory