BetterDocs CVE-2026-75980

Exploitation requires the attacker to hold a valid WordPress account with at minimum contributor-level role on the target site - anonymous or subscriber-level users cannot create or publish posts and are not a valid attack vector. The vulnerable code path is only triggered when the BetterDocs Table of Contents shortcode (process_content_for_toc() in ToC.php) processes a post or documentation page containing a heading element whose id attribute carries entity-encoded JavaScript. A victim user must subsequently visit the page containing the injected content for the payload to execute. Limiting factors are: (1) contributor or higher WordPress role is mandatory for post creation; (2) the BetterDocs plugin must be installed, active, and configured to render the ToC shortcode on the affected page type; (3) victim page visit is required for execution - the payload does not propagate automatically. Sites that do not provision contributor accounts to untrusted parties are not exposed to this attack path.

The CVSS 6.4 Medium score reflects Scope:Changed (XSS payload executes in the victim browser context outside the plugin) with the PR:L prerequisite for a valid contributor account moderating overall severity. In multi-author WordPress environments where contributor accounts are routinely provisioned to content editors or external writers, this risk is non-trivial: injected pages persist silently until the stored content is audited and remediated. No EPSS data was provided, and the CVE has not been added to the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The technical sophistication of the bypass - entity-encoding to survive wp_kses_post, then html_entity_decode exposure inside the ToC pipeline - suggests discovery through deliberate security research by Wordfence rather than organic attacker discovery, which mildly reduces near-term weaponization probability. However, the Wordfence public disclosure now provides sufficient implementation detail and source code references for independent reproduction by a capable attacker, so deferring remediation on actively-edited sites is inadvisable.

An attacker with a contributor-level WordPress account crafts a BetterDocs documentation page whose heading contains an id attribute with entity-encoded JavaScript (for example, encoded event handlers or URI-based payloads) that passes wp_kses_post validation and is stored in the database. When any visitor later loads that page, the BetterDocs ToC shortcode calls html_entity_decode() on the stored heading, a lazy regex extracts the unescaped id, and the payload is echoed unescaped into the rendered Table of Contents HTML - executing attacker-controlled JavaScript in the victim's browser and enabling session hijacking, credential harvesting, or malicious redirection. No public proof-of-concept has been confirmed, though the Wordfence disclosure references exact source file lines sufficient for independent reproduction.