CVE-2026-121862 · Other
NO FIX YET · SEE WHAT TO DO
The Knowledge Building WordPress plugin before 0.7.3 does not sanitise or escape comments submitted through its reply feature, and publishes them without moderation. An unauthenticated visitor can plant script that runs in the browser of anyone who views the affected posts, including administrators.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Knowledge Building WordPress plugin before 0.7.3 that use its comment reply feature. The flaw needs no login, so any site visitor can submit the payload; sites without the plugin or on 0.7.3 or later are not affected.
Not affected if plugin-not-installed, plugin-version-0.7.3-or-later, reply-feature-unused
Who cares knowledge-building, self-hosted, wordpress
0.7.3 is affected.0.7.3 or later.The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, and publishes them without moderation, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against any visitor of the affected posts, including administrators.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.