Description
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'connectorWidth' Block Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-07-03
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The weDocs plugin for WordPress is vulnerable to stored cross‑site scripting (CWE‑79) through the 'connectorWidth' block attribute because input is not sanitized and output is not escaped. Authenticated users with contributor‑level privileges and above can embed arbitrary JavaScript into visitor views that page, the injected script executes in the visitor’s browser, but whether it allows remote code execution on the server is not explicitly described; based on the information provided, it appears that the plugin does not permit RCE on the server.

Affected Systems

The vulnerability exists in all versions of the weDocs plugin up to and including version 2.3.0. Any WordPress installation that has this plugin at one of those versions is affected. the product is the AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin.

Risk and Exploitability

The CVSS score of 6.4 classifies the flaw as moderate. The EPSS score is less than 1%, indicating a. The vulnerability is not listed in KEV., compromised accounts; once access is achieved, exploitation is straightforward and impacts all users who view the compromised page.

Generated by OpenCVE AI on July 21, 2026 at 10:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the weDocs plugin to a version that removes the XSS flaw, following the vendor’s release notes.
  • If an upgrade cannot be performed immediately, restrict the contributor role’s ability to edit the 'connectorWidth' block—either by adjusting role capabilities or disabling that block via plugin settings—to prevent storage of malicious scripts.
  • Deploy a content filtering or sanitization solution that blocks JavaScript or script tags in editor input, ensuring that any malicious scripts are removed before rendering, until the plugin can be updated.

Generated by OpenCVE AI on July 21, 2026 at 10:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Wedevs
Wedevs wedocs: Ai Powered Knowledge Base, Docs, Documentation, Wiki & Ai Chatbot
Wordpress
Wordpress wordpress
Vendors & Products Wedevs
Wedevs wedocs: Ai Powered Knowledge Base, Docs, Documentation, Wiki & Ai Chatbot
Wordpress
Wordpress wordpress

Mon, 06 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 03 Jul 2026 01:45:00 +0000

Type Values Removed Values Added
Description The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'connectorWidth' Block Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'connectorWidth' Block Attribute
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Wedevs Wedocs: Ai Powered Knowledge Base, Docs, Documentation, Wiki & Ai Chatbot
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-06T16:23:38.805Z

Reserved: 2026-06-19T16:06:32.290Z

Link: CVE-2026-12734

cve-icon Vulnrichment

Updated: 2026-07-06T16:23:34.500Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T10:30:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')