---
id: "CVE-2026-121862"
page: "https://infrastack.ai/live/CVE-2026-121862"
kind: "vulnerability"
aliases: ["CVE-2026-121862"]
title: "Knowledge Building WordPress plugin: unmoderated comments allow stored script injection"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["knowledge-building", "other", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed", "plugin-version-0.7.3-or-later", "reply-feature-unused"]
published_at: "2026-11-11T06:17:16+00:00"
first_seen_at: "2026-11-11T06:25:42+00:00"
updated_at: "2026-11-11T06:27:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121862", "first_seen_at": "2026-11-11T06:25:42+00:00"}]
exploit_sources: []
---

# Knowledge Building WordPress plugin: unmoderated comments allow stored script injection

Link for people: https://infrastack.ai/live/CVE-2026-121862 (this .md is for agents)

The Knowledge Building WordPress plugin before 0.7.3 does not sanitise or escape comments submitted through its reply feature, and publishes them without moderation. An unauthenticated visitor can plant script that runs in the browser of anyone who views the affected posts, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Knowledge Building plugin in the WordPress admin under Plugins; a version below `0.7.3` is affected.
- Confirm the plugin's reply feature is in use on your posts.

## Fix

- Knowledge Building plugin: move to `0.7.3` or later.

## Timeline

- 2026-11-11T06:25:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121862

## From the sources

The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, and publishes them without moderation, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against any visitor of the affected posts, including administrators.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_