Betterdocs Ai Documentation Knowledge Base Mcp Server Docs Wikis Faq Chatbot
Monthly
Stored cross-site scripting in the BetterDocs WordPress plugin (versions through 4.8.1) allows contributor-level authenticated attackers to inject persistent JavaScript that executes in any visitor's browser context. The flaw exploits a two-stage processing gap: entity-encoded quotes in a heading id attribute pass WordPress's wp_kses_post sanitization at save time, but are later decoded by html_entity_decode() inside process_content_for_toc(), after which a lazy regex extracts the now-unescaped value and echoes it directly into the Table of Contents HTML output. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored cross-site scripting in the BetterDocs WordPress plugin (versions through 4.8.1) allows contributor-level authenticated attackers to inject persistent JavaScript that executes in any visitor's browser context. The flaw exploits a two-stage processing gap: entity-encoded quotes in a heading id attribute pass WordPress's wp_kses_post sanitization at save time, but are later decoded by html_entity_decode() inside process_content_for_toc(), after which a lazy regex extracts the now-unescaped value and echoes it directly into the Table of Contents HTML output. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.