echoplugins vulnerabilities and threats

The Echo Knowledge Base plugin for WordPress has a reflected cross-site scripting (XSS) vulnerability in versions up to 17.214.0. This flaw arises from improper input sanitization and output escaping in certain plugin functions, allowing unauthenticated attackers to inject malicious scripts via the 'new_kb_config' parameter. Exploitation requires tricking users with Editor-level or higher privileges into clicking crafted links, potentially leading to script execution in their browsers.

Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.

Missing Authorization vulnerability in echoplugins Knowledge Base for Documentation, FAQs with AI Assistance echo-knowledge-base allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knowledge Base for Documentation, FAQs with AI Assistance: from n/a through <= 16.011.0.

The Creative Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.5.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.