The weDocs WordPress plugin contains a stored XSS flaw in the modalPlaceholder block attribute that is not properly sanitized or escaped. Authenticated users with contributor or higher privileges can save a malicious payload in a block, and the payload will run in the browsers of any admin or editor who preview or view the pending post. This allows arbitrary script execution, potentially enabling defacement, cookie theft, or session hijacking for viewers of that content. The weakness is an insufficient input validation and output encoding flaw, classified as CWE‑79.

All installations of the weDocs plugin by WeDevs for WordPress up to version 2.6.1 are affected. Any site running these versions and allowing contributors to create or edit posts with modalPlaceholder blocks could be exposed.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires contributor‑level access, it cannot be exploited by unauthenticated attackers, yet any site with contributors can be used as an attack vector. The risk of impact is heightened on high‑traffic sites where pending posts are viewed by admins or editors frequently.