PT-2026-145022

CVE-2026-121862

Published

2026-11-11

Updated

2026-11-11

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, and publishes them without moderation, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against any visitor of the affected posts, including administrators.

Exploitability

Exploit

Fix

Impacts

Researchers

Claudio Marchesini

Dottor Marc

Enrico Marcolini

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')