The weDocs plugin for WordPress contains a stored cross‑site scripting flaw that arises from the lack of proper sanitization and escaping in the block attributes "sectionTitleTag" and "articleTitleTag". Because these attributes are rendered directly into page content, an authenticated user with contributor-level or higher privileges can embed arbitrary JavaScript code. When a visitor subsequently views a page that contains the compromised block, the injected script runs in the victim’s browser and can deface content, steal session cookies, or perform phishing actions from the client side.

All WordPress sites that have installed the weDocs plugin version 2.3.0 or earlier are affected. The plugin is distributed under the wedevs:weDocs product line. Sites that have not applied an update beyond 2.3.0 remain vulnerable to the stored XSS through the "sectionTitleTag" and "articleTitleTag" attributes.

The vulnerability carries a CVSS score of 6.4, reflecting medium severity. Its EPSS score is less than 1% and it is not listed in the CISA KEV catalogue, indicating a low probability of widespread exploitation. Attackers must be authenticated with contributor-level access or higher, after which they can inject malicious payloads that will execute in the browsers of any user who visits the affected page. While the exploit does not grant server‑side code execution or direct access to site files, it can compromise user sessions and deface or manipulate visible content at the client level.