BetterDocs CVE-2026-65562

The attacker must have at least Contributor role in the WordPress site (authenticated, low privileges). The crafted content must be visited by a user with higher privileges, typically an administrator (user interaction required). No special configuration is necessary; the vulnerability exists in default BetterDocs installations. The attack is limited by the requirement for existing Contributor accounts and the need for an admin to view the injected content.

The CVSS base score of 6.5 (Medium) reflects the need for authenticated Contributor access and user interaction (admin must view the crafted content). The attack vector is network-accessible, and exploitation is automatable via crafted content. However, no public exploit code or active exploitation has been identified (no KEV listing, no POC mentioned). The EPSS score is not provided, but given the need for authenticated access and user interaction, the real-world risk is moderate. The vulnerability is scoped to impact confidentiality, integrity, and availability at a low level. It is not a high-priority threat unless the site allows Contributor registration and has active low-privilege contributors.

A malicious user with Contributor-level access creates or edits a documentation page in BetterDocs and inserts a malicious script tag. When an administrator visits the page to review or approve it, the script executes, exfiltrating the administrator's session cookies to an attacker-controlled server. No public exploit code has been reported.