CVE-2026-101935: Echo Knowledge Base <= 17.214.0 - Reflected Cross-Site Scripting via 'new_kb_config' Parameter
The Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'newkbconfig' parameter (specifically the article-mobile-break-point-v2 key, among other config keys interpolated into the <style> element) in versions up to, and including, 17.214.0 This is due to insufficient input sanitization and output escaping in EPKBFrontendEditor::fepreviewconfig() and EPKBArticlesSetup: on every knowledge base article page view, when the request supplies epkbfereloadmode=on, an attacker-controlled JSON blob is merged over the stored KB configuration and several values are concatenated directly into a stylesheet emitted inside a literal <style> element without escaping (minifycss() does not strip <, > or /). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user (with Editor-level access or above, holding the managecategories capability, or an Administrator) into performing an action such as clicking on a specially crafted link.
Affected Software
Event History
Frequently Asked Questions
Who must interact with the malicious request for the injected script to execute?
A user with Editor-level access or higher who has the manage_categories capability, or an Administrator, must be tricked into clicking a specially crafted link. The attacker does not need to be authenticated.
What request conditions are required to trigger the vulnerable code path?
The request must target a knowledge base article page and include epkb_fe_reload_mode=on. It must also supply a crafted new_kb_config JSON blob containing attacker-controlled configuration values, such as article-mobile-break-point-v2.
What is the immediate mitigation if updating is not possible?
No specific workaround is provided. Reduce exposure by warning privileged knowledge-base users and administrators not to follow untrusted links, since exploitation relies on convincing one of them to open a crafted URL.
How can I assess whether my installation is affected?
Installations running Echo Knowledge Base version 17.214.0 or earlier are affected according to the available information. The vulnerable behavior is associated with article-page requests that enable frontend-editor reload mode and pass new_kb_config values.