The Smart Docs WordPress plugin suffers from a stored cross‑site scripting flaw in versions 1.1.0 and earlier. Insufficient sanitization of attributes passed to the 'smartdocs_search' shortcode allows an authenticated user with contributor or higher privileges to embed malicious scripts. When a targeted page is viewed, the injected code executes in the visitor’s browser, enabling session theft, defacement, or data exfiltration.

This vulnerability affects the Smart Docs plugin from ibachal, available on WordPress. All WordPress installations running Smart Docs 1.1.0 or earlier are susceptible. The plugin version information indicates community‑released plugin versions; any site that has installed the vulnerable plugin—regardless of WordPress core version—is at risk.

The CVSS score of 6.4 designates moderate severity. The EPSS score below 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires an authenticated contributor or higher, so only users with that role can inject the malicious code. Attackers may embed scripts that run when other site visitors load the affected pages, but collateral damage is limited to the victim’s browser session. Because the flaw is owner‑controlled content and requires legitimate login, the attack surface is constrained, though any compromised contributor account becomes a vector.