CVE-2026-12731
MediumCVSS 6.4Summary
The weDocs plugin for WordPress up to version 2.3.0 is vulnerable to Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute whenever a user visits an affected page.
Risk Assessment
The risk includes session hijacking, data theft, or malware distribution through script execution in the victim's browser. Attackers with low privileges can permanently alter page content, compromising system integrity and confidentiality.
Recommendation
Immediately update the weDocs plugin to the latest available version that fixes this vulnerability. Until then, restrict user permissions and deploy a Web Application Firewall (WAF) to block XSS attacks.
Original NVD description (English source)
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.