Echo Knowledge Base Documentation Faqs Chat Smart Search
Monthly
Reflected cross-site scripting in the Echo Knowledge Base - Documentation, FAQs, Chat & Smart Search plugin for WordPress (versions up to and including 17.214.0) lets a remote attacker place arbitrary script in a knowledge base article page by supplying an epkb_fe_reload_mode=on request that carries a crafted new_kb_config JSON blob, whose values are merged over the stored KB configuration and concatenated unescaped into a <style> element. Rated CVSS 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and tracked as CWE-79, the practical ceiling is limited: the payload only executes in the browser of a logged-in user with Editor-level access or above holding the manage_categories capability, or an Administrator, and that user must be tricked into clicking the crafted link (UI:R), so anonymous visitors and ordinary readers cannot be targeted. No public exploit code was identified in the supplied intelligence and there is no CISA KEV entry; the vuln.today decision label is 'this_month' rather than act_now or emergency. Vulnerability details were reported by Wordfence and cross-referenced by ENISA as EUVD-2026-111818.
Reflected cross-site scripting in the Echo Knowledge Base - Documentation, FAQs, Chat & Smart Search plugin for WordPress (versions up to and including 17.214.0) lets a remote attacker place arbitrary script in a knowledge base article page by supplying an epkb_fe_reload_mode=on request that carries a crafted new_kb_config JSON blob, whose values are merged over the stored KB configuration and concatenated unescaped into a <style> element. Rated CVSS 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and tracked as CWE-79, the practical ceiling is limited: the payload only executes in the browser of a logged-in user with Editor-level access or above holding the manage_categories capability, or an Administrator, and that user must be tricked into clicking the crafted link (UI:R), so anonymous visitors and ordinary readers cannot be targeted. No public exploit code was identified in the supplied intelligence and there is no CISA KEV entry; the vuln.today decision label is 'this_month' rather than act_now or emergency. Vulnerability details were reported by Wordfence and cross-referenced by ENISA as EUVD-2026-111818.