{"id":"CVE-2026-101935","kind":"vulnerability","aliases":["CVE-2026-101935"],"related":[],"title":"Echo Knowledge Base WordPress plugin: unauthenticated script injection via config parameter","description":"The Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'new_kb_config' parameter (specifically the article-mobile-break-point-v2 key, among other config keys interpolated into the <style> element) in versions up to, and including, 17.214.0 This is due to insufficient input sanitization and output escaping in EPKB_Frontend_Editor::fe_preview_config() and EPKB_Articles_Setup: on every knowledge base article page view, when the request supplies epkb_fe_reload_mode=on, an attacker-controlled JSON blob is merged over the stored KB configuration and several values are concatenated directly into a stylesheet emitted inside a literal <style> element without escaping (minify_css() does not strip <, > or /). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user (with Editor-level access or above, holding the manage_categories capability, or an Administrator) into performing an action such as clicking on a specially crafted link.","summary":"The Echo Knowledge Base plugin for WordPress, up to and including 17.214.0, places attacker-supplied configuration values into a style element without escaping. An attacker can make scripts run in a logged-in user's browser on the site if that user clicks a crafted link.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["knowledge-base","package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","version-above-17.214.0"],"how_to_check":"- Open the Plugins screen in WordPress admin and check whether Echo Knowledge Base is installed at `17.214.0` or earlier.\n- Search web server access logs for requests containing `epkb_fe_reload_mode=on` and a `new_kb_config` parameter.","fix":"- Update Echo Knowledge Base to a release newer than `17.214.0`; the sources do not name the fixed version.\n- Remove the plugin if it is not needed.","status":"open","published_at":"2026-10-28T08:16:29+00:00","first_seen_at":"2026-10-28T08:31:53+00:00","triaged_at":"2026-10-28T08:33:54+00:00","updated_at":"2026-10-28T08:33:54+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T08:33:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update Echo Knowledge Base to a release newer than `17.214.0`; the sources do not name the fixed version.\n- Remove the plugin if it is not needed.","reach":"internet","title":"Echo Knowledge Base WordPress plugin: unauthenticated script injection via config parameter","impact":"medium","summary":"The Echo Knowledge Base plugin for WordPress, up to and including 17.214.0, places attacker-supplied configuration values into a style element without escaping. An attacker can make scripts run in a logged-in user's browser on the site if that user clicks a crafted link.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted","knowledge-base"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker script runs in victim's browser session on the site.","analyst_note":"","how_to_check":"- Open the Plugins screen in WordPress admin and check whether Echo Knowledge Base is installed at `17.214.0` or earlier.\n- Search web server access logs for requests containing `epkb_fe_reload_mode=on` and a `new_kb_config` parameter.","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-above-17.214.0"],"who_is_affected":"Sites running Echo Knowledge Base at version `17.214.0` or earlier are exposed. The injection is reached through knowledge base article pages, so any site serving those pages with the plugin active is in scope. Sites without the plugin, or running a newer release, can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.001327,"input_tokens":3610,"output_tokens":1933,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101935':14A,17A '-2026':13A,16A '17.214.0':40B 'among':112C 'articl':106C 'article-mobile-break-point-v2':105C 'attack':43B,54B 'attacker-suppli':42B 'base':3A,20B,32B,80C 'break':108C 'browser':66B 'chat':83C 'click':73B 'config':10A,101C,114C 'configur':45B 'craft':75B 'cross':94C 'cross-sit':93C 'cve':12A,15A 'document':81C 'echo':1A,30B,78C 'element':50B 'escap':52B 'faq':82C 'host':24B 'includ':39B 'inject':8A 'interpol':116C 'kb':100C 'key':111C,115C 'knowledg':2A,19B,31B,79C 'knowledge-bas':18B 'link':76B 'log':62B 'logged-in':61B 'make':56B 'mobil':107C 'new':99C 'packag':21B 'paramet':11A,102C 'place':41B 'plugin':5A,28B,33B,86C 'point':109C 'reflect':92C 'run':58B 'script':7A,57B,96C 'search':85C 'self':23B 'self-host':22B 'site':69B,95C 'smart':84C 'specif':103C 'style':49B 'suppli':44B 'unauthent':6A 'user':64B,72B 'v2':110C 'valu':46B 'via':9A,97C 'vulner':90C 'without':51B 'wordpress':4A,25B,27B,35B,88C 'wordpress-plugin':26B","nicknames":[],"mitigations":[],"who_affected":"Sites running Echo Knowledge Base at version `17.214.0` or earlier are exposed. The injection is reached through knowledge base article pages, so any site serving those pages with the plugin active is in scope. Sites without the plugin, or running a newer release, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T08:16:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101935","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101935","severity":null,"published_at":"2026-10-28T08:16:29+00:00","modified_at":"2026-10-28T08:16:29+00:00","first_seen_at":"2026-10-28T08:31:53+00:00","fetched_at":"2026-10-28T08:31:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}