The Smart Docs plugin for WordPress contains a stored Cross‑Site Scripting weakness in its admin configuration that is triggered by insufficient input filtering and lack of output escaping. An attacker who has administrator channel access and above in a multi‑site WordPress deployment where the unfiltered_html capability has been disabled can embed arbitrary client‑side scripts that will be served to any user who views the affected configuration pages. This flaw gives the attacker the ability to run code in the victim’s browser context, potentially compromising session cookies, defacing content, or exfiltrating sensitive information, thereby jeopardising both confidentiality and integrity as well as the broader availability of the site to legitimate users.

The flaw afflicts versions of the Smart Docs plugin up to and including 1.1.1 distributed by the vendor ibachal. It is specific to WordPress installations configured for multiple sites and where the option to allow unfiltered_html output has been turned off, meaning it only applies to environments that have tightened the default filtering behavior for administrators. All other single‑site installs or those retaining the unfiltered_html setting are unaffected.

The CVSS score of 5.5 rates this flaw as medium severity, but the EPSS estimate of less than 1% indicates a very low probability of real‑world exploitation at this time. Because the vulnerability requires administrator‑level authentication and a specific multi‑site configuration with filtered HTML, the likelihood of widespread deployment of an attack vector remains low, and the flaw is not currently listed in CISA’s KEV catalog. Nevertheless, once a site owner has granted admin rights in a filtered environment, the attacker can quickly poison the stored configuration data, allowing the malicious script to run on every subsequent view by any logged‑on user.