Knowledge Building < 0.7.3 – Reflected XSS via Comment Reply Response | CVE 2026-121863

Description

The plugin does not escape several user-supplied values before echoing them back in the response of an AJAX action available to unauthenticated users, and serves that response as HTML, leading to a Reflected Cross-Site Scripting.

Proof of Concept

The PoC will be displayed on December 09, 2026, to give users the time to update.

Affects Plugins

knowledge-building

Fixed in 0.7.3

References

CVE

CVE-2026-121863

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

7.1 (high)

Miscellaneous

Verified

Yes

WPVDB ID

80b4b9d0-e48b-4f24-b4bd-71dc37ac1602

Timeline

Publicly Published

2026-11-09 (about 2 days ago)

Added

2026-11-09 (about 1 day ago)

Last Updated

2026-11-09 (about 1 day ago)

Other

Published

Title

Published

2024-04-24

Title

Shortcodes Ultimate < 7.1.2 - Contributor+ Stored XSS

Published

2024-10-17

Title

Suki Sites Import <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

Published

2026-06-23

Title

WP Latest Posts <= 5.0.11 - Authenticated (Author+) Stored Cross-Site Scripting via Post Content Image src Attribute

Published

2014-08-01

Title

WP Lead Management 3.0.0 - Script Insertion Vulnerabilities

Published

2026-09-24

Title

wpForo Forum < 3.1.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field