BetterDocs vulnerabilities
3 known CVE vulnerabilities in BetterDocs, translated and rated.
- CVE-2026-65562Medium
The BetterDocs plugin version 4.6.2 and earlier has a Cross-Site Scripting (XSS) vulnerability for users with the Contributor role. A Contributor can inject malicious JavaScript code.
- CVE-2026-11371Medium
The BetterDocs WordPress plugin before version 4.5.5 does not sanitize an AI-generated documentation summary before storing and outputting it. The feature is exposed to unauthenticated users, allowing them to store a malicious payload via prompt injection that executes in the browser of any visitor, including administrators.
- CVE-2026-15104Medium
The BetterDocs plugin for WordPress up to version 4.6.0 is vulnerable to generic SQL injection via the 'lang' parameter. Authenticated attackers with custom-level access or higher can append additional SQL queries, allowing extraction of sensitive database information. Exploitation requires an active multilingual plugin (WPML, Polylang, qTranslate, Weglot, or TranslatePress).