{"id":"CVE-2026-121862","kind":"vulnerability","aliases":["CVE-2026-121862"],"related":[],"title":"Knowledge Building WordPress plugin: unmoderated comments allow stored script injection","description":"The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, and publishes them without moderation, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against any visitor of the affected posts, including administrators.","summary":"The Knowledge Building WordPress plugin before 0.7.3 does not sanitise or escape comments submitted through its reply feature, and publishes them without moderation. An unauthenticated visitor can plant script that runs in the browser of anyone who views the affected posts, including administrators.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["knowledge-building","other","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-0.7.3-or-later","reply-feature-unused"],"how_to_check":"- Check the installed version of the Knowledge Building plugin in the WordPress admin under Plugins; a version below `0.7.3` is affected.\n- Confirm the plugin's reply feature is in use on your posts.","fix":"- Knowledge Building plugin: move to `0.7.3` or later.","status":"open","published_at":"2026-11-11T06:17:16+00:00","first_seen_at":"2026-11-11T06:25:42+00:00","triaged_at":"2026-11-11T06:27:32+00:00","updated_at":"2026-11-11T06:27:32+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T06:27:32Z","model":"claude-haiku-5-5","output":{"fix":"- Knowledge Building plugin: move to `0.7.3` or later.","reach":"internet","title":"Knowledge Building WordPress plugin: unmoderated comments allow stored script injection","impact":"medium","summary":"The Knowledge Building WordPress plugin before 0.7.3 does not sanitise or escape comments submitted through its reply feature, and publishes them without moderation. An unauthenticated visitor can plant script that runs in the browser of anyone who views the affected posts, including administrators.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","knowledge-building","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker script runs in administrators' browsers, enabling account takeover.","analyst_note":"","how_to_check":"- Check the installed version of the Knowledge Building plugin in the WordPress admin under Plugins; a version below `0.7.3` is affected.\n- Confirm the plugin's reply feature is in use on your posts.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-version-0.7.3-or-later","plugin-not-installed","reply-feature-unused"],"who_is_affected":"Sites running the Knowledge Building WordPress plugin before 0.7.3 that use its comment reply feature. The flaw needs no login, so any site visitor can submit the payload; sites without the plugin or on 0.7.3 or later are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000733,"input_tokens":4548,"output_tokens":557,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121862':13A,16A '-2026':12A,15A '0.7.3':31B,74C 'administr':67B,110C 'affect':64B,107C 'allow':7A,91C 'anyon':60B 'attack':101C 'browser':58B 'build':2A,19B,27B,70C 'comment':6A,37B,80C 'cross':98C 'cross-sit':97C 'cve':11A,14A 'escap':36B,79C 'featur':42B,85C 'host':23B 'includ':66B,109C 'inject':10A 'knowledg':1A,18B,26B,69C 'knowledge-build':17B 'moder':47B,90C 'perform':95C 'plant':52B 'plugin':4A,29B,72C 'post':65B,108C 'publish':44B,87C 'repli':41B,84C 'run':55B 'sanitis':34B,77C 'script':9A,53B,100C 'self':22B 'self-host':21B 'site':99C 'store':8A,96C 'submit':38B,81C 'unauthent':49B,92C 'unmoder':5A 'user':93C 'view':62B 'visitor':50B,104C 'without':46B,89C 'wordpress':3A,24B,28B,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Knowledge Building WordPress plugin before 0.7.3 that use its comment reply feature. The flaw needs no login, so any site visitor can submit the payload; sites without the plugin or on 0.7.3 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["knowledgebuilding","medium","other","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-121862':13A,16A '-2026':12A,15A 'allow':7A 'build':2A 'comment':6A 'cve':11A,14A 'inject':10A 'knowledg':1A 'plugin':4A 'script':9A 'store':8A 'unmoder':5A 'wordpress':3A","search_b":"'0.7.3':31B 'administr':67B 'affect':64B 'anyon':60B 'browser':58B 'build':19B,27B 'comment':37B 'escap':36B 'featur':42B 'host':23B 'includ':66B 'knowledg':18B,26B 'knowledge-build':17B 'moder':47B 'plant':52B 'plugin':29B 'post':65B 'publish':44B 'repli':41B 'run':55B 'sanitis':34B 'script':53B 'self':22B 'self-host':21B 'submit':38B 'unauthent':49B 'view':62B 'visitor':50B 'without':46B 'wordpress':24B,28B","search_c":"'0.7.3':74C 'administr':110C 'affect':107C 'allow':91C 'attack':101C 'build':70C 'comment':80C 'cross':98C 'cross-sit':97C 'escap':79C 'featur':85C 'includ':109C 'knowledg':69C 'moder':90C 'perform':95C 'plugin':72C 'post':108C 'publish':87C 'repli':84C 'sanitis':77C 'script':100C 'site':99C 'store':96C 'submit':81C 'unauthent':92C 'user':93C 'visitor':104C 'without':89C 'wordpress':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121862","severity":null,"published_at":"2026-11-11T06:17:16+00:00","modified_at":"2026-11-11T06:17:16+00:00","first_seen_at":"2026-11-11T06:25:42+00:00","fetched_at":"2026-11-11T06:25:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}