What is the CVSS score of CVE-2026-3875?

CVE-2026-3875 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-3875

EUVD-2026-23209 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-16 Wordfence

GHSA-2jv9-g2gr-pf4j

XSS WordPress Elementor

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 16, 2026 - 07:50 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 07:30 euvd

EUVD-2026-23209

Analysis Generated

Apr 16, 2026 - 07:30 vuln.today

CVE Published

Apr 16, 2026 - 06:44 nvd

MEDIUM 6.4

DescriptionCVE.org

The BetterDocs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'betterdocs_feedback_form' shortcode in all versions up to, and including, 4.3.8. This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in BetterDocs WordPress plugin versions up to 4.3.8 allows authenticated attackers with contributor-level access to inject arbitrary JavaScript into pages via the 'betterdocs_feedback_form' shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the browsers of all users who view affected pages, enabling account compromise, credential theft, or malware distribution. No public exploit code or active exploitation has been identified at this time.

Technical ContextAI

The BetterDocs plugin for WordPress provides knowledge base and FAQ functionality integrated with page builders like Elementor and the WordPress block editor. The vulnerability exists in the 'betterdocs_feedback_form' shortcode handler, which processes user-supplied shortcode attributes without proper sanitization before storing them in the database (Stored XSS) or escaping them during output rendering. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) issue where attacker-controlled data flows directly into HTML/JavaScript context without transformation. The shortcode attribute parsing mechanism likely passes untrusted input directly to template rendering functions, and the feedback form display code fails to apply WordPress escaping functions (esc_attr, wp_kses_post, etc.) appropriate for the output context.

RemediationAI

Update BetterDocs to version 4.3.9 or later immediately via the WordPress admin dashboard (Plugins > Installed Plugins > BetterDocs > Update) or directly at plugins.wordpress.org. The patch applied by the vendor adds proper input sanitization and output escaping to the 'betterdocs_feedback_form' shortcode attribute handling (confirmed by changeset diff at plugins.trac.wordpress.org). No workarounds are available for older versions. As a temporary compensating control, site administrators can restrict contributor-level role assignment to trusted users only via Settings > Users and review existing contributor accounts for suspicious activity. However, this does not remediate existing stored XSS payloads that may already be present in published pages - stored XSS payloads must be manually removed from affected page content and post revisions before patching.