CVE-2026-28187 HIGH

CVE-2026-28187: WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 17.211.0 - Cross Site Scripting (XSS) vulnerability

Vendor Echoplugins
Product Knowledge Base for Documentation, FAQs with AI Assistance
Weakness CWE-79 · XSS
Published August 13, 2026
Last update August 13, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.

Explanation of Vulnerability in Simple Terms

02Summary

The Knowledge Base for Documentation, FAQs with AI Assistance plugin contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts. An attacker can craft a malicious link or page that, when visited by a site user, executes arbitrary JavaScript in the victim's browser. This can lead to session hijacking, credential theft, or defacement. The vulnerability affects versions up to 17.211.0.

What an attacker can do

03Attacker Capabilities

Inject and execute malicious JavaScript in visitors' browsers to steal sessions, credentials, or deface content.

Potential impact on your site

04Site Impact

Visitors' accounts and data are at risk; attackers can impersonate users or modify site content seen by others.

Conditions required to exploit

05Prerequisites

Attacker crafts a malicious link or page; a site visitor must click it or visit the affected page.

Key dates

06Disclosure timeline

August 13, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-49466 Draft List - Contributor Stored Cross-Site Scripting via Draft Title in Custom Drafts Template Attributes CVE-2026-12801 Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes CVE-2026-3639 PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2026-66700 WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-61974 WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability