Reflected Cross-Site Scripting Vulnerability in Echo Knowledge Base Plugin for WordPress

CVE-2026-101935

What is CVE-2026-101935?

The Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search plugin for WordPress is susceptible to reflected cross-site scripting. This vulnerability originates from inadequate input sanitization and output escaping within certain plugin functionalities. Specifically, when a page of a knowledge base article is accessed, the plugin may incorporate attacker-controlled data into the output. If an attacker successfully deceives a user with Editor privileges or higher into interacting with a crafted link, they can execute arbitrary scripts in the context of the user’s session, potentially leading to unauthorized actions or data exposure.

References