Description
The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoing them back in the response of an AJAX action available to unauthenticated users, and serves that response as HTML, leading to a Reflected Cross-Site Scripting.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Knowledge Building | < 0.7.3 | 0.7.3 |
References
- https://wpscan.com/vulnerability/80b4b9d0-e48b-4f24-b4bd-71dc37ac1602/ exploit vdb-entry technical-description