What is the CVSS score of CVE-2026-28187?

CVE-2026-28187 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Echo Knowledge Base are affected by CVE-2026-28187?

The Echo Knowledge Base WordPress plugin (versions 17.211.0 and earlier) contains a cross-site scripting vulnerability that allows remote attackers to inject and execute malicious code in user…

How to fix or mitigate CVE-2026-28187?

Within 24 hours, identify and disable the Echo Knowledge Base plugin on all WordPress instances or restrict its access to administrators only. Within 7 days, confirm patch availability timeline with the vendor and evaluate alternative knowledge base solutions; implement Web Application Firewall rules to block common XSS payloads as temporary mitigation. Within 30 days, deploy the patched plugin version once available, or migrate to an alternative knowledge base platform without known security vulnerabilities.

Echo Knowledge Base CVE-2026-28187

EUVD-2026-57965 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Patchstack

GHSA-55x8-6vf8-2m59

WordPress XSS Wordpress Plugin Knowledge Base For Documentation Faqs With Ai Assistance

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-delivered XSS with no auth required; UI:R and S:C reflect browser-scope execution requiring victim interaction; C/I/A:L appropriate for session-limited impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:50 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.

AnalysisAI

Unauthenticated cross-site scripting in the Echo Knowledge Base WordPress plugin (versions <= 17.211.0) allows a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session. The vulnerability requires no authentication to exploit but does require a victim to interact with the affected content, as reflected in the CVSS UI:R metric and scope change (S:C). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this accessible to unsophisticated attackers targeting WordPress deployments running this plugin.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize user-controlled input before rendering it in an HTML context, allowing injection of executable script. The affected product is the 'echo-knowledge-base' WordPress plugin (CPE: cpe:2.3:a:echoplugins:knowledge_base_for_documentation,_faqs_with_ai_assistance:*:*:*:*:*:*:*:*), which provides documentation, FAQ, and AI-assisted knowledge base functionality within WordPress sites. The XSS is classified as unauthenticated, meaning the injection vector is accessible without any WordPress account. The CVSS S:C (scope changed) metric confirms that script execution escapes the vulnerable plugin's own context and operates within the victim user's browser session - a defining characteristic of cross-site scripting. The exact XSS variant (reflected vs. stored) is not explicitly stated in the available data.

RemediationAI

Update the echo-knowledge-base WordPress plugin to a version beyond 17.211.0 immediately, as all versions up to and including this release are confirmed vulnerable. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/echo-knowledge-base/vulnerability/wordpress-knowledge-base-for-documentation-faqs-with-ai-assistance-plugin-17-211-0-cross-site-scripting-xss-vulnerability should be consulted for the specific patched release version, which was not explicitly stated in the available data. As a compensating control pending patching, site administrators can disable the affected plugin entirely, accepting the loss of knowledge base and FAQ functionality. A Web Application Firewall (WAF) with XSS filtering rules applied to plugin endpoints may reduce exploitation risk but should not be treated as a permanent substitute for patching. WordPress plugin auto-updates should be enabled to reduce exposure windows for future vulnerabilities in this plugin.