EUVD-2026-41467
GHSA-fm2m-jw2h-jf5r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS requires a victim to load the page (UI:R); contributor access required (PR:L); scope changes to victim browser (S:C); no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'connectorWidth' Block Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the weDocs WordPress plugin (all versions through 2.3.0) allows authenticated contributors to inject persistent malicious scripts via the unsanitized 'connectorWidth' block attribute in the Sidebar block renderer (render.php lines 138 and 161). Any site visitor loading an affected documentation page triggers the payload in their browser, enabling session hijacking, credential harvesting, or malicious redirects. No active exploitation is confirmed in CISA KEV and no public exploit has been identified at time of analysis, though the attack technique is low-complexity for anyone with block editor knowledge.
Technical ContextAI
The weDocs plugin (CPE: cpe:2.3:a:wedevs:wedocs) provides AI-augmented knowledge base and documentation functionality for WordPress via the block editor (Gutenberg). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the server-side PHP render callback for the Sidebar block echoes the 'connectorWidth' block attribute directly into HTML output at render.php lines 138 and 161 without applying WordPress escaping functions such as esc_attr() or esc_html(). WordPress block attributes are user-controlled values stored in post content in the database; unsanitized server-side rendering of these values means the injected script persists and executes for every subsequent page load. A changeset (3589430) has been committed to the WordPress plugin SVN repository, indicating the vulnerability has been addressed upstream.
RemediationAI
Update the weDocs plugin to the version released after 2.3.0 that incorporates changeset 3589430 from the WordPress plugin SVN repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3589430%40wedocs&new=3589430%40wedocs); the exact patched release version number is not independently confirmed from available data and should be verified via the WordPress plugin page or the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/11d68c98-3d7e-42af-be61-6bb5428b73b6. Until patching is possible, restrict contributor-level role assignment strictly to trusted, vetted users - this removes the attack surface entirely since exploitation requires at minimum contributor access. If the Sidebar block feature can be disabled in weDocs plugin settings, doing so eliminates the specific injection point at the cost of losing sidebar navigation functionality on documentation pages. Sites using Wordfence WAF may receive virtual patching coverage; confirm rule applicability with Wordfence.
Stored Cross-Site Scripting in the weDocs WordPress plugin (versions through 2.3.0) allows authenticated contributors to
Missing authorization in weDevs weDocs WordPress plugin through version 2.1.18 allows unauthenticated remote attackers t
Missing authorization on the BetterDocs-to-weDocs migration AJAX endpoint in the weDocs WordPress plugin (versions up to
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today