CVE-2026-101935
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search plugin for WordPress in versions up to and including 17.214.0 is vulnerable to Reflected Cross-Site Scripting via the 'new_kb_config' parameter, specifically the article-mobile-break-point-v2 key. This is due to insufficient input sanitization and output escaping in EPKB_Frontend_Editor::fe_preview_config() and EPKB_Articles_Setup, where attacker-controlled data is concatenated into a <style> element without escaping. This allows unauthenticated attackers to inject arbitrary scripts that execute if they trick a user with Editor-level access or above into clicking a crafted link.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session theft, account takeover, or content modification. This requires interaction from a user with editor or administrator privileges.
Recommendation
Update the Echo Knowledge Base plugin to a version later than 17.214.0 that fixes the XSS vulnerability. Until then, avoid clicking unknown links and consider restricting editor privileges.
Related vulnerabilities
- CVE-2026-121609Critical
A vulnerability was identified in the Qihoo 360 Whole Home Router M5 version 4.0.17.1566 within the boot script /etc/init.d/mpt (Home function). The issue involves hard-coded credentials. The exploit is publicly available and remote exploitation is possible.
- CVE-2026-121607Critical
A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to version 6.4.9 in the testspeed_command function of /fs2/bin/iscm. Manipulating the host argument results in OS command injection. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-121606Critical
A vulnerability was found in Qihoo 360 devices (models D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9) in the verify_sign function of fs2/bin/iscm responsible for firmware signature verification. Manipulating the sign argument leads to improper verification of cryptographic signatures. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-121600Critical
A vulnerability was found in TOTOLINK A950RG version 4.1.2cu.5268_B20221104 in the setMacFilterRules function of /cgi-bin/cstecgi.cgi handling MAC filtering. Manipulating the addEffect argument causes a stack-based buffer overflow. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2026-121599Critical
A vulnerability was detected in TOTOLINK A950RG version 4.1.2cu.5268_B20221104 in the setWiFiMultipleConfig/delWiFiMultipleConfig functions of /cgi-bin/cstecgi.cgi handling Multi-SSID configuration. Manipulating the wepkey2/wepkey3 arguments results in a stack-based buffer overflow. The attack can be launched remotely and the exploit is now public.
- CVE-2026-121598Critical
A security vulnerability was detected in TOTOLINK A950RG version 4.1.2cu.5268_B20221104 in the strcpy function of /cgi-bin/cstecgi.cgi handling basic wireless configuration. Manipulating the wepkey argument leads to a stack-based buffer overflow. The attack can be initiated remotely and the exploit has been publicly disclosed.
- CVE-2026-92190Critical
Quest Foglight for Databases contains a deserialization of untrusted data vulnerability in the baseRmiServiceExporter component. An unauthenticated remote attacker can execute arbitrary code in the context of SYSTEM.
- CVE-2026-92189Critical
In Quest Foglight for Databases, the writeTopologySectionToFile method does not validate a user-supplied path before using it in file operations. An unauthenticated remote attacker can execute arbitrary code in the context of SYSTEM.
- CVE-2026-92188Critical
The ForgeMBeanServerSupport module in Quest Foglight for Databases lacks authentication before allowing access to functionality. An unauthenticated remote attacker can execute arbitrary code in the context of SYSTEM.
- CVE-2026-121597Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the setAppEasyWizardConfig function in /cgi-bin/cstecgi.cgi mishandles the functionType argument, leading to a stack-based buffer overflow. The attack can be performed remotely and a public exploit is available.
Original NVD description (English source)
The Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'new_kb_config' parameter (specifically the article-mobile-break-point-v2 key, among other config keys interpolated into the <style> element) in versions up to, and including, 17.214.0 This is due to insufficient input sanitization and output escaping in EPKB_Frontend_Editor::fe_preview_config() and EPKB_Articles_Setup: on every knowledge base article page view, when the request supplies epkb_fe_reload_mode=on, an attacker-controlled JSON blob is merged over the stored KB configuration and several values are concatenated directly into a stylesheet emitted inside a literal <style> element without escaping (minify_css() does not strip <, > or /). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user (with Editor-level access or above, holding the manage_categories capability, or an Administrator) into performing an action such as clicking on a specially crafted link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS