Knowledge Building: Unauthenticated stored cross-site scripting in comments
Summary
The Knowledge Building WordPress plugin before 0.7.3 does not sanitise or escape comments submitted through its reply feature and publishes them without moderation. An unauthenticated attacker can store malicious scripts that run in the browser of any visitor to the affected posts, including administrators. The CVSS 8.8 score was supplied with the data but is not yet confirmed by NVD, which still shows status Received.
Affected
- Knowledge Building WordPress plugin, all versions before 0.7.3
- Exact version history: Unknown.
Fixed in
- Version 0.7.3 (verify the installed version in the WordPress plugin list).
Workaround
- Not needed if version 0.7.3 or later is installed.
- If updating is delayed: deactivate the plugin, disable public comments, or set comments to manual moderation.
- Review existing comments on affected posts for injected script content.
Exploitation
- No known exploitation (OffSeq: not known to be exploited).
- Not listed in CISA KEV.
- Public proof of concept: Unknown.
Our recommendation
- Identify all WordPress sites that run the plugin.
- Update to version 0.7.3 or later.
- Review comments on affected posts and remove script content.
- If a site was exposed before patching, check administrator accounts for unexpected changes.
- Monitor logs for unusual administrator activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory wpscan.com
- CVE Record (CVE Program) www.cve.org
- OpenCVE app.opencve.io
- OffSeq Radar: CVE-2026-121862 radar.offseq.com
- OffSeq Radar: fix in 0.7.3 radar.offseq.com
- Strix: CVE-2026-121862 www.strix.ai
- ThreatINT: CVE-2026-121862 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:26.
Original description (NVD)
The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, and publishes them without moderation, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against any visitor of the affected posts, including administrators.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.