CVE-2026-121863: Knowledge Building < 0.7.3 - Reflected XSS via Comment Reply Response
The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoing them back in the response of an AJAX action available to unauthenticated users, and serves that response as HTML, leading to a Reflected Cross-Site Scripting.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the vulnerable AJAX action?
The affected AJAX action is available to unauthenticated users, so an attacker does not need a WordPress account to submit crafted input.
What conditions are required for exploitation?
An attacker needs to cause a target to receive or load a crafted request that supplies malicious values to the comment-reply AJAX action. The response is served as HTML, allowing the reflected script to execute in the target's browser.
Which releases are affected?
Knowledge Building versions before 0.7.3 are affected. Version 0.7.3 is the first version identified as not affected by this issue.