CVE-2026-121862: Knowledge Building < 0.7.3 - Unauthenticated Stored XSS via knbu_new_reply AJAX Action
The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, and publishes them without moderation, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against any visitor of the affected posts, including administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk?
An unauthenticated attacker can submit a malicious reply through the plugin’s reply feature. Any visitor viewing an affected post that contains the published reply can be exposed, including WordPress administrators.
Does exploitation require comment approval or moderation?
No. Replies submitted through the affected feature are published without moderation, so an attacker does not need an account or approval before the payload is shown to visitors.
Which installations are affected?
Knowledge Building versions before 0.7.3 are affected. The available information does not identify configuration prerequisites beyond use of the plugin’s reply feature.