What is the CVSS score of EUVD-2026-37982?

EUVD-2026-37982 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

BetterDocs EUVD-2026-37982

| CVE-2026-12157 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-19 Wordfence

GHSA-hcf9-p628-6437

WordPress XSS Wordpress Plugin Betterdocs Ai Documentation Knowledge Base Docs Wikis Faq With Chatbot Wpdevteam

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

PR:L confirmed by contributor-level requirement; S:C because injected script executes in victim browser context; A:N as no availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 06:34 vuln.today

CVE Published

Jun 19, 2026 - 04:31 nvd

MEDIUM 6.4

DescriptionCVE.org

The BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blockId attribute of the betterdocs/category-slate-layout Gutenberg block in versions up to, and including, 4.5.3. This is due to insufficient input sanitization and output escaping in the CategorySlateLayout::render() method, which echoes the blockId block attribute directly into an HTML class attribute without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in BetterDocs WordPress plugin (versions ≤4.5.3) allows authenticated contributors to inject persistent malicious scripts via the unescaped blockId attribute of the betterdocs/category-slate-layout Gutenberg block. The injected payload executes in the browser of any visitor who loads the compromised page, enabling session hijacking, credential theft, or admin-level privilege escalation against site operators. No public exploit identified at time of analysis, but the contributor-level authentication threshold makes this accessible on any WordPress site permitting open or shared content authorship.

Technical ContextAI

BetterDocs (CPE: cpe:2.3:a:wpdevteam:betterdocs_-__ai_documentation,_knowledge_base,_docs,_wikis,_faq_with_chatbot) is a WordPress plugin providing knowledge base, FAQ, wiki, and documentation functionality integrated with both the Gutenberg block editor and Elementor. The vulnerable code resides in the CategorySlateLayout::render() method at includes/Editors/BlockEditor/Blocks/CategorySlateLayout.php (lines 66 and 97, confirmed via WordPress SVN at tags/4.5.3 and tags/4.3.12). The blockId block attribute - which identifies individual block instances - is echoed directly into an HTML class attribute without invoking WordPress's built-in esc_attr() sanitization function. This is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) violation: user-controlled data flows from block editor input into rendered HTML output without encoding, and because the payload persists in the WordPress database as block content, every subsequent page load delivers the attack to new victims.

RemediationAI

An upstream fix is available via WordPress plugin SVN changeset 3576713 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3576713%40betterdocs&new=3576713%40betterdocs), which addresses the missing esc_attr() call in CategorySlateLayout::render(). Administrators should update BetterDocs to the version released after 4.5.3 via the WordPress plugin dashboard as the primary remediation; note that the exact patched release version number was not specified in the available data and should be verified against the official WordPress plugin page before updating. As a compensating control prior to patching, administrators should audit and revoke contributor-level access for any untrusted or unnecessary accounts - reducing or eliminating the population of users who can author Gutenberg blocks. If the betterdocs/category-slate-layout block is not actively used, disabling the BetterDocs plugin entirely or restricting block editor capabilities to editor-level and above via a capability management plugin (e.g., Members) provides meaningful risk reduction with the trade-off of limiting documentation functionality.