Knowledge Building
Knowledge Building has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 2 are fixed as of November 2026. Their average CVSS score is 6.7, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2026 was the busiest year with 2 disclosures.
The most common weakness is Improper Neutralization Of Input During Web Page Generation, behind 2 of the records (100%).
Every one of the 2 issues recorded for Knowledge Building has a vendor fix available, so running the current release closes all known holes.
All of these findings were reported by Enrico Marcolini. Knowledge Building is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.
CVE-2026-121862Knowledge Building < 0.7.3 - Unauthenticated Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Knowledge Building
Author
Tarmo Toikkanen
Knowledge Building is a process of collaboratively building new understanding and knowledge through meaningful discussion. This plugin allows knowledge building processes to happen on WordPress comments. There are several different knowledge typesets to choose from, and they can be mapped to individual post categories, so other posts will continue to use their normal commenting functionality, while some categories will be equipped with knowledge building tools. This plugin is primarily meant for use in educational settings, but can of course be used for any meaningful purpose. Each discussion can also be explored as an interactive map, where notes are shown as connected nodes that can be grouped by discussion thread, knowledge type, author or time. The plugin uses the jQuery and jQuery UI libraries that come with WordPress. The map view uses the Raphaël vector graphics library (MIT license) and the Junge font by Cyreal (SIL Open Font License), both included in the plugin. Apart from avatars, which follow your site’s avatar settings, the plugin doesn’t load anything from external servers. For more regular updates see GitHub.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C