BetterDocs EUVD-2026-37982

Exploitation requires a valid WordPress account with at minimum contributor-level privileges, as this is the lowest role permitted to create and publish Gutenberg block content via the block editor. The vulnerable code path activates only when a page containing a betterdocs/category-slate-layout block is rendered to a browser, meaning the block must actually be placed on a published page for victims to be exposed. The CVSS PR:L metric confirms the authentication requirement. Exploitation is further bounded to WordPress installations running BetterDocs version 4.5.3 or earlier with the Gutenberg block editor active. What limits exploitation: sites that restrict contributor registration, require administrator approval for content publication, or enforce a capability model where only trusted roles can author BetterDocs blocks are materially less exposed than open-registration documentation communities.

The CVSS 6.4 score is driven primarily by the Scope:Changed metric (S:C), reflecting that injected JavaScript executes in the victim's browser - a separate security context from the WordPress server. The PR:L metric confirms exploitation requires at minimum contributor-level WordPress authentication, which constrains the attacker pool compared to PR:N vulnerabilities but remains meaningful on community documentation sites, multi-author platforms, or any deployment allowing user registration. AC:L indicates no special timing or race conditions are needed beyond having a valid contributor account. No CISA KEV listing and no EPSS data were provided; no confirmed public exploit code exists at time of analysis. The real-world risk profile is moderate-to-significant for affected deployments: sites with locked-down contributor rosters have reduced exposure, while sites with open registration or multiple external contributors should treat this as an immediate patching priority. The UI:N metric reflects that the attacker need not induce any separate victim interaction to store the payload - delivery occurs automatically when any user visits the poisoned page, consistent with stored XSS behavior.

An attacker who has obtained or registered a contributor-level WordPress account navigates to the block editor, inserts a betterdocs/category-slate-layout block, and sets the blockId attribute to a crafted value such as ' onmouseover=alert(document.cookie) x=' that escapes the HTML class attribute context and injects executable JavaScript. Once the page is published, every subsequent visitor - including site administrators - triggers the script on page load, enabling the attacker to exfiltrate session cookies, forge admin actions, or redirect users to phishing pages. No public exploit code has been identified at time of analysis.