WordPress security by component

BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot

Plugin description

BetterDocs creates documentation, knowledge bases, wikis, frequently asked questions, and chatbot-assisted help content in WordPress.

BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot (betterdocs) is a WordPress plugin with 14 published CVE records in this archive. The latest tracked vulnerability was published Sep 01, 2026; the highest published CVSS base score is 9.

Plugin slug: betterdocs

Latest vulnerability

CVE-2026-75980: BetterDocs heading IDs permit Contributor-level stored cross-site scripting

BetterDocs through 4.8.1 permits a Contributor or higher to place entity-encoded quotes in a heading id attribute. The value survives wp_kses_post(), then process_content_for_toc() decodes the stored content, extracts the malformed id, and emits it into the Table of Contents without adequate escaping, causing stored script to execute when a user views the affected page.

PublishedSep 01, 2026

Safe version guidanceSee mitigation notes

Published vulnerabilities for betterdocs
		Safe version
Sep 01, 2026	CVE-2026-75980 BetterDocs heading IDs permit Contributor-level stored cross-site scripting BetterDocs through 4.8.1 permits a Contributor or higher to place entity-encoded quotes in a heading id attribute. The value survives wp_kses_post(), then process_content_for_toc() decodes the stored content, extracts the malformed id, and emits it into the Table of Contents without adequate escaping, causing stored script to execute when a user views the affected page.	See mitigation notes	CVE6.4 NVDPending
Jul 27, 2026	CVE-2026-65562 BetterDocs contributor input permits cross-site scripting BetterDocs through 4.6.2 lets a Contributor supply attacker-controlled input that reaches a browser-executable output context without adequate neutralization. The payload can execute in the site's origin when another user views the crafted output.	4.7.0	CVE6.5 NVDPending
Jul 16, 2026	CVE-2026-11371 BetterDocs: A security weakness BetterDocs is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is 4.0.0 to < 4.5.5.	4.5.5	CVE6.1 NVDPending
Jul 10, 2026	CVE-2026-15104 BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot: SQL injection BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.6.0.	See mitigation notes	CVE6.5 NVDPending
Jun 19, 2026	CVE-2026-12157 BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot: Cross-site scripting BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 4.5.3.	See mitigation notes	CVE6.4 NVDPending
Apr 29, 2026	CVE-2026-42644 BetterDocs: A security weakness BetterDocs is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.3.10.	4.3.11	CVE5.3 NVDPending
Apr 24, 2026	CVE-2026-6393 BetterDocs – Knowledge Base Docs & FAQ Solution for Elementor & Block Editor: A security weakness BetterDocs – Knowledge Base Docs & FAQ Solution for Elementor & Block Editor is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.3.11.	See mitigation notes	CVE4.3 NVDPending
Apr 16, 2026	CVE-2026-3875 BetterDocs – Knowledge Base Docs & FAQ Solution for Elementor & Block Editor: Cross-site scripting BetterDocs – Knowledge Base Docs & FAQ Solution for Elementor & Block Editor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 4.3.8.	See mitigation notes	CVE6.4 NVDPending
Jan 09, 2026	CVE-2025-14980 BetterDocs: Sensitive information exposure BetterDocs is affected by sensitive information exposure. Exploitation requires an authenticated contributor account. Successful exploitation can disclose data that should not be available to the caller.	See mitigation notes	CVE6.5 NVDPending
Aug 16, 2025	CVE-2025-7499 Betterdocs: A security weakness Betterdocs is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Dec 09, 2024	CVE-2023-47762 BetterDocs: A security weakness BetterDocs is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3 NVDPending
Aug 13, 2024	CVE-2024-43129 BetterDocs: Filesystem traversal BetterDocs is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE6.5 NVD8.8
Aug 12, 2024	CVE-2024-43227 BetterDocs: Cross-site scripting BetterDocs is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5 NVD5.4
Mar 28, 2024	CVE-2024-30226 BetterDocs: Code execution BetterDocs is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE9.0 NVDPending

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers