CVE-2026-121862 Knowledge Building < 0.7.3 - Unauthenticated Stored XSS via knbu_new_reply AJAX Action
Unauthenticated users can store scripts in Knowledge Building replies that run for any visitor, including administrators.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Harmful if only installed
- No
- Needs a specific call
- No
- Fix
- None listed
What is CVE-2026-121862?
CVE-2026-121862 is a high-severity cross-site scripting vulnerability in Unknown Knowledge Building, published on 11 Nov 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, and publishes them without moderation, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against any visitor of the affected posts, including administrators.
Weakness: CWE-79
Which versions are affected by CVE-2026-121862?
An affected version is exposed as installed. No special setting or call is needed.
How do I fix CVE-2026-121862?
No fix has been published for CVE-2026-121862 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-121862 being exploited?
There is no known exploitation of CVE-2026-121862 in the wild and no public exploit code.
Sources
Also known as GHSA-vxm8-8rj5-3798.