Stored Cross-Site Scripting Vulnerability in Knowledge Base Plugin by WordPress

CVE-2025-7431

What is CVE-2025-7431?

The Knowledge Base plugin for WordPress is susceptible to stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping, particularly through the plugin slug setting. This vulnerability allows authenticated attackers with administrator-level access to inject arbitrary web scripts into pages, which execute when a user accesses an affected page. It mainly impacts multi-site installations, especially when the unfiltered_html setting is disabled, making it critical for administrators to apply necessary updates and sanitization practices.

References