CVE-2026-12731
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The weDocs plugin for WordPress up to version 2.3.0 contains a stored XSS vulnerability via the 'sectionTitleTag' and 'articleTitleTag' block attributes. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary scripts that execute whenever a user visits an injected page.
Risk Assessment
The organization is at risk of user session theft, administrator account takeover, and malware distribution through compromised documentation pages.
Recommendation
Immediately update the weDocs plugin to the latest available version that fixes this vulnerability. Restrict user permissions to the minimum necessary.
Other vulnerabilities in weDocs
See all- CVE-2026-12734Medium
The weDocs plugin for WordPress up to version 2.3.0 contains a stored XSS vulnerability via the 'connectorWidth' block attribute. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary scripts that execute when a user visits an affected page.
- CVE-2026-12729Medium
The weDocs plugin for WordPress up to version 2.3.0 has a missing authorization vulnerability in the do_migration() function. Authenticated attackers with Subscriber-level access can trigger a data migration from BetterDocs to weDocs, creating and modifying 'docs' custom post type entries and deactivating BetterDocs plugins.
- CVE-2026-39520Medium
The weDocs plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.