Description
The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives wp_kses_post because entity-encoded quotes in a heading id attribute are treated as a single legitimate attribute value at save time; the dangerous payload only materialises after process_content_for_toc() calls html_entity_decode() on the stored content and the broken id is extracted by a lazy regex before being echoed unescaped into the Table of Contents output.
Published: 2026-09-01
Score: 6.4 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is compromised by a stored cross‑site scripting flaw that allows an authenticated contributor or higher to inject malicious web scripts into page content. The flaw exists in all releases up to 4.8.1 because the plugin fails to sanitize or escape the heading 'id' attribute before persisting and later echoing it in the Table of Contents. When a user views the injected page, the stored payload is decoded and output unescaped, executing arbitrary JavaScript in the viewer’s browser.

Affected Systems

The affected vendor is wpdevteam, and the product is the BetterDocs plugin for WordPress. All installed copies of BetterDocs up to and including version 4.8.1 are vulnerable. Users running any earlier release are not impacted, while those on later releases that incorporate the fix are safe.

Risk and Exploitability

The CVSS score of 6.4 reflects a moderate severity, and the vulnerability is listed in no KEV catalog. Although the EPSS score is not available, the need for contributor‑level access means that the attack surface is limited to users with certain editing privileges. The stored XSS can lead to theft of session cookies, defacement, or execution of arbitrary scripts, compromising confidentiality and integrity of the site’s users. Given the straightforward injection path via heading tags and the lack of output escaping, the risk remains significant for any site still running a vulnerable BetterDocs version.

Generated by OpenCVE AI on September 1, 2026 at 06:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the BetterDocs plugin to version 4.8.2 or later, which includes input validation and output escaping for heading id attributes.
  • If an upgrade is not immediately feasible, remove or sanitize the offending heading id attributes from existing post content, for example by editing posts to delete the id attribute or converting headings to plain text, then re‑save them.
  • Consider revoking contributor or higher role permissions for editing posts or disabling the Table of Contents feature until the plugin is fixed.

Generated by OpenCVE AI on September 1, 2026 at 06:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 05:45:00 +0000

Type Values Removed Values Added
Description The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives wp_kses_post because entity-encoded quotes in a heading id attribute are treated as a single legitimate attribute value at save time; the dangerous payload only materialises after process_content_for_toc() calls html_entity_decode() on the stored content and the broken id is extracted by a lazy regex before being echoed unescaped into the Table of Contents output.
Title BetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-09-01T05:30:41.748Z

Reserved: 2026-08-18T18:21:26.796Z

Link: CVE-2026-75980

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-01T06:16:37.830

Modified: 2026-09-01T06:16:37.830

Link: CVE-2026-75980

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T06:30:11Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')