Knowledge Building

Knowledge Building has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 2 are fixed as of November 2026. Their average CVSS score is 6.7, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Improper Neutralization Of Input During Web Page Generation, behind 2 of the records (100%).

Every one of the 2 issues recorded for Knowledge Building has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by Enrico Marcolini. Knowledge Building is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.

Strategic Overview

Avg CVSSMedium
6.7/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Knowledge Building vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2026-121862

Knowledge Building < 0.7.3 - Unauthenticated Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records
Plugin Profile
Latestv0.8.1

Knowledge Building

Tarmo Toikkanen

Author

Tarmo Toikkanen

5.0(1)
100/100
Last Updated
2026-11-07 (4d ago)
Active Installs
10+
Downloads
5,423
Requires WP
5.7+
Requires PHP
7.0+
Tested up to
WP 7.1.4
Created
2009-09-11 (17y ago)

Knowledge Building is a process of collaboratively building new understanding and knowledge through meaningful discussion. This plugin allows knowledge building processes to happen on WordPress comments. There are several different knowledge typesets to choose from, and they can be mapped to individual post categories, so other posts will continue to use their normal commenting functionality, while some categories will be equipped with knowledge building tools. This plugin is primarily meant for use in educational settings, but can of course be used for any meaningful purpose. Each discussion can also be explored as an interactive map, where notes are shown as connected nodes that can be grouped by discussion thread, knowledge type, author or time. The plugin uses the jQuery and jQuery UI libraries that come with WordPress. The map view uses the Raphaël vector graphics library (MIT license) and the Junge font by Cyreal (SIL Open Font License), both included in the plugin. Apart from avatars, which follow your site’s avatar settings, the plugin doesn’t load anything from external servers. For more regular updates see GitHub.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C