CVE-2026-121862
HIGH
MEDIUM
Priority: 0.04
BB Relevance:
68/100
Published: 2026-11-11
Modified: 2026-11-11
First seen: 2026-11-11
Status: active
Attack Surface
Network
Low Complexity
No Auth
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Required
S:
Unchanged
C:
High
I:
High
A:
High
Description
The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, and publishes them without moderation, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against any visitor of the affected posts, including administrators.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| Unknown | Knowledge Building | 0 < 0.7.3 |
| Unknown | Knowledge Building | 0 < 0.7.3 |