CVE-2026-121863
HIGH
NVD
CVSS Score
7.1
Severity
HIGH
Published
Nov 11, 2026
Vendor
unknown
Description
The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoing them back in the response of an AJAX action available to unauthenticated users, and serves that response as HTML, leading to a Reflected Cross-Site Scripting.