WordPress weDocs Authenticated Stored XSS via Block Attributes (CVE-2026-12731)

Vulnerability Overview Vulnerability Name: weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes CVE ID: CVE-2026-12731 CVSS Score: 6.4 (Medium) Release Date: July 2, 2026 Last Updated: July 3, 2026 Researcher: PRISM Affected Software Software Type: Plugin Software Name: weDocs (view on wordpress.org) Affected Versions: <= 2.3.0 Fixed Version: 2.3.1 Remediation Remediation Status: Fixed Fixed Version: Upgrade to version 2.3.1 or higher Vulnerability Description The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin contains a stored Cross-Site Scripting (XSS) vulnerability in WordPress via the 'sectionTitleTag' and 'articleTitleTag' block attributes. Due to insufficient input sanitization and output escaping, this vulnerability allows authenticated attackers (with Contributor privilege or higher) to execute arbitrary scripts when users visit pages containing the injected script. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Related Vulnerabilities: - weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Data Migration via weDocs_migrate_betterdocs_to_weDocs AJAX Action - weDocs <= 2.1.18 - Missing Authorization - weDocs <= 2.1.16 - Missing Authorization to Authenticated (Subscriber+) Documentation Post Update - weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.1.15 - Unauthenticated Sensitive Information Exposure - weDocs <= 2.1.14 - Missing Authorization to Settings Update - weDocs <= 2.1.4 - Missing Authorization - Appsero <= 1.2.1 - Missing Authorization - Appsero <= 1.2.0 - Cross-Site Request Forgery Copyright Information Copyright: 2012-2026 Defiant Inc. License: Used in accordance with the licensing terms of Defiant Inc. Contact Information Technical Support: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support, 365 days, 1-hour response time Other Resources Learn More: Learn More Get Wordfence: Get Wordfence Documentation: Documentation Footer Information Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Facebook: Facebook Twitter: Twitter LinkedIn: LinkedIn Instagram: Instagram Products and Support Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form Subscribe for Updates Stay Updated: Register to receive news and updates from our team of experienced security professionals. Copyright Statement © 2012-2026 Defiant Inc. All Rights Reserved Other Have you been hacked? Get Help: Get Help Create Account: Create Account Sign In: Sign In View Pricing: View Pricing Summary This page primarily describes a stored Cross-Site Scripting (XSS) vulnerability in the weDocs plugin, affecting versions <= 2.3.0, and provides remediation steps and related references. The page also lists other related vulnerabilities and detailed information.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress weDocs Authenticated Stored XSS via Block Attributes (CVE-2026-12731)

More from this source