{"affected":[{"defaultStatus":"unaffected","product":"Knowledge Building","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"0.7.3","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-121863","cwes":["CWE-79"],"description":"The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoing them back in the response of an AJAX action available to unauthenticated users, and serves that response as HTML, leading to a Reflected Cross-Site Scripting.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/80b4b9d0-e48b-4f24-b4bd-71dc37ac1602/"}],"kev":null,"metrics":[],"modifiedAt":1794376811485,"publishedAt":1794376811485,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/80b4b9d0-e48b-4f24-b4bd-71dc37ac1602/"}],"remediation":[],"revision":"435ff31212559323435714ceb02a16cf25a7403e573510a0bb707f209579d36d","sources":[{"modifiedAt":1794376811485,"name":"CNA: WPScan","retrievedAt":1794377398387,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121863"}],"ssvc":null,"status":"published","title":"Knowledge Building < 0.7.3 - Reflected XSS via Comment Reply Response","updatedAt":1794377398387}