{"id":"CVE-2026-121863","kind":"vulnerability","aliases":["CVE-2026-121863"],"related":[],"title":"Knowledge Building WordPress plugin: reflected cross-site scripting via unauthenticated AJAX action","description":"The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoing them back in the response of an AJAX action available to unauthenticated users, and serves that response as HTML, leading to a Reflected Cross-Site Scripting.","summary":"The Knowledge Building WordPress plugin before 0.7.3 echoes several user-supplied values back unescaped in an AJAX response served as HTML. An attacker can craft a link that runs script in a visitor's browser, in the context of the affected site.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["knowledge-building","other","wordpress"],"not_affected_if":["plugin-not-installed","version-0.7.3-or-later"],"how_to_check":"- Check the installed version of the Knowledge Building plugin in the WordPress admin under Plugins; versions below `0.7.3` are affected.","fix":"- Knowledge Building plugin: move to `0.7.3` or later, per the advisory's stated fixed version.","status":"open","published_at":"2026-11-11T06:17:16+00:00","first_seen_at":"2026-11-11T06:25:42+00:00","triaged_at":"2026-11-11T06:27:30+00:00","updated_at":"2026-11-11T06:27:30+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T06:27:30Z","model":"claude-haiku-5-5","output":{"fix":"- Knowledge Building plugin: move to `0.7.3` or later, per the advisory's stated fixed version.","reach":"internet","title":"Knowledge Building WordPress plugin: reflected cross-site scripting via unauthenticated AJAX action","impact":"medium","summary":"The Knowledge Building WordPress plugin before 0.7.3 echoes several user-supplied values back unescaped in an AJAX response served as HTML. An attacker can craft a link that runs script in a visitor's browser, in the context of the affected site.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","knowledge-building"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Script runs in visitors' browsers, stealing sessions or redirecting users","analyst_note":"","how_to_check":"- Check the installed version of the Knowledge Building plugin in the WordPress admin under Plugins; versions below `0.7.3` are affected.\n- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-0.7.3-or-later"],"who_is_affected":"Sites running the Knowledge Building WordPress plugin before 0.7.3. The AJAX action is available to unauthenticated users, so no login is needed to reach the vulnerable response. Sites without this plugin can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000715,"input_tokens":4536,"output_tokens":522,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121863':16A,19A '-2026':15A,18A '0.7.3':31B,74C 'action':13A,93C 'affect':66B 'ajax':12A,42B,92C 'attack':48B 'avail':94C 'back':38B,86C 'browser':60B 'build':2A,22B,27B,70C 'context':63B 'craft':50B 'cross':7A,109C 'cross-sit':6A,108C 'cve':14A,17A 'echo':32B,84C 'escap':77C 'html':46B,103C 'knowledg':1A,21B,26B,69C 'knowledge-build':20B 'lead':104C 'link':52B 'plugin':4A,29B,72C 'reflect':5A,107C 'respons':43B,89C,101C 'run':54B 'script':9A,55B,111C 'serv':44B,99C 'sever':33B,78C 'site':8A,67B,110C 'suppli':36B,81C 'unauthent':11A,96C 'unescap':39B 'user':35B,80C,97C 'user-suppli':34B,79C 'valu':37B,82C 'via':10A 'visitor':58B 'wordpress':3A,24B,28B,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Knowledge Building WordPress plugin before 0.7.3. The AJAX action is available to unauthenticated users, so no login is needed to reach the vulnerable response. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["knowledgebuilding","medium","other","wordpress"],"campaign_type":null,"search_a":"'-121863':16A,19A '-2026':15A,18A 'action':13A 'ajax':12A 'build':2A 'cross':7A 'cross-sit':6A 'cve':14A,17A 'knowledg':1A 'plugin':4A 'reflect':5A 'script':9A 'site':8A 'unauthent':11A 'via':10A 'wordpress':3A","search_b":"'0.7.3':31B 'affect':66B 'ajax':42B 'attack':48B 'back':38B 'browser':60B 'build':22B,27B 'context':63B 'craft':50B 'echo':32B 'html':46B 'knowledg':21B,26B 'knowledge-build':20B 'link':52B 'plugin':29B 'respons':43B 'run':54B 'script':55B 'serv':44B 'sever':33B 'site':67B 'suppli':36B 'unescap':39B 'user':35B 'user-suppli':34B 'valu':37B 'visitor':58B 'wordpress':24B,28B","search_c":"'0.7.3':74C 'action':93C 'ajax':92C 'avail':94C 'back':86C 'build':70C 'cross':109C 'cross-sit':108C 'echo':84C 'escap':77C 'html':103C 'knowledg':69C 'lead':104C 'plugin':72C 'reflect':107C 'respons':89C,101C 'script':111C 'serv':99C 'sever':78C 'site':110C 'suppli':81C 'unauthent':96C 'user':80C,97C 'user-suppli':79C 'valu':82C 'wordpress':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121863","severity":null,"published_at":"2026-11-11T06:17:16+00:00","modified_at":"2026-11-11T06:17:16+00:00","first_seen_at":"2026-11-11T06:25:42+00:00","fetched_at":"2026-11-11T06:25:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}