CVE-2026-101935
Received Received - Intake

Reflected Cross-Site Scripting in Echo Knowledge Base WordPress Plugin

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: Wordfence

Description
The Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'new_kb_config' parameter (specifically the article-mobile-break-point-v2 key, among other config keys interpolated into the <style> element) in versions up to, and including, 17.214.0 This is due to insufficient input sanitization and output escaping in EPKB_Frontend_Editor::fe_preview_config() and EPKB_Articles_Setup: on every knowledge base article page view, when the request supplies epkb_fe_reload_mode=on, an attacker-controlled JSON blob is merged over the stored KB configuration and several values are concatenated directly into a stylesheet emitted inside a literal <style> element without escaping (minify_css() does not strip <, > or /). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user (with Editor-level access or above, holding the manage_categories capability, or an Administrator) into performing an action such as clicking on a specially crafted link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-101935
EUVD
EUVD-2026-111818

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
echoplugins Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reflected Cross-Site Scripting (XSS) vulnerability in the Echo Knowledge Base WordPress plugin. It allows unauthenticated attackers to inject malicious scripts via the 'new_kb_config' parameter, specifically targeting the 'article-mobile-break-point-v2' key. The issue occurs because user input is not properly sanitized before being included in a stylesheet rendered in a <style> element on knowledge base article pages.

Detection Guidance

This vulnerability can be detected by checking for the Echo Knowledge Base plugin versions up to and including 17.214.0. Inspect WordPress sites for the presence of the plugin and verify its version. Look for unusual stylesheet injections or script executions in knowledge base article pages when the epkb_fe_reload_mode=on parameter is used.

Impact Analysis

An attacker could trick a user with Editor-level access or higher into clicking a malicious link, leading to arbitrary script execution in their browser. This could result in session hijacking, defacement of the website, or theft of sensitive data. The attack requires user interaction but can be executed without authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. If exploited, it may result in data breaches, triggering compliance violations and potential legal penalties.

Mitigation Strategies

Immediately update the Echo Knowledge Base plugin to the latest version beyond 17.214.0. If an update is not available, consider disabling the plugin temporarily until a patch is released. Review user roles with Editor-level access or above to ensure least privilege principles are followed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101935. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart