Echo Knowledge Base CVE-2026-101935

Exploitation requires a request that supplies epkb_fe_reload_mode=on against a knowledge base article page, carrying an attacker-controlled new_kb_config JSON blob (notably the article-mobile-break-point-v2 key and other config keys interpolated into the <style> element), which is merged over the stored KB configuration and emitted without escaping (minify_css() does not strip <, > or /). The decisive limiting factor is that the injected script only executes for a logged-in user with Editor-level access or above holding the manage_categories capability, or an Administrator, AND that user must be tricked into clicking the crafted link (UI:R) - so a visitor or anonymous reader cannot be targeted, materially reducing realistic impact. Affects default behavior of versions up to and including 17.214.0.

This is a genuine but lower-tier priority - a reflected XSS (CWE-79) rated CVSS 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) with the vuln.today decision label 'this_month' rather than act_now/emergency. The vector signals network reach, low complexity and no attacker authentication (PR:N), but it is gated by UI:R: exploitation requires tricking a victim into clicking a crafted link. The single most important limiting signal is in the description, not the CVSS: the injected script only executes in the browser of a user who already holds Editor-level-or-above privileges (manage_categories capability) or Administrator - so the victim pool is small and privileged, which sharply narrows real-world exploitability despite the 'unauthenticated attacker' framing. There is no CISA KEV listing and no EPSS value supplied, and no confirmed working exploit code is provided in the input - only the Wordfence advisory and WordPress trac source/changeset links - so exploitation status is 'no public exploit identified at time of analysis.' Signals are internally consistent (no CVSS-vs-description conflict), but the absence of EPSS/KEV plus the privileged-victim requirement together point to this being a real-but-not-urgent issue suitable for routine patching rather than emergency response.

An unauthenticated attacker crafts a link to a knowledge base article page that appends epkb_fe_reload_mode=on and a malicious new_kb_config JSON blob (e.g. via the article-mobile-break-point-v2 key), whose value is concatenated unescaped into a <style> element. The attacker sends this link to a site Editor or Administrator; when that privileged user clicks it, the injected script executes in their authenticated browser session. No confirmed working exploit code is provided in the input - only the Wordfence advisory and trac source references.