CVE-2026-12734
MediumCVSS 6.4Summary
The weDocs plugin for WordPress up to version 2.3.0 contains a stored XSS vulnerability via the 'connectorWidth' block attribute. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary scripts that execute when a user visits an affected page.
Risk Assessment
The risk includes session hijacking, data theft, or malware distribution through script execution on WordPress pages, potentially compromising the entire site's security.
Recommendation
Immediately update the weDocs plugin to the latest available version that fixes this vulnerability. Also, restrict user permissions to the minimum necessary.
Original NVD description (English source)
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'connectorWidth' Block Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.