Description

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives wp_kses_post because entity-encoded quotes in a heading id attribute are treated as a single legitimate attribute value at save time; the dangerous payload only materialises after process_content_for_toc() calls html_entity_decode() on the stored content and the broken id is extracted by a lazy regex before being echoed unescaped into the Table of Contents output.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-01T06:16:37.830Z",
  "pubdate": "2026-09-01T06:16:37.830Z",
  "executiveSummary": "The BetterDocs plugin for WordPress, in versions up to and including 4.8.1, contains a stored Cross-Site Scripting (XSS) vulnerability within its Table of Contents (TOC) generation mechanism.\nThe flaw stems from improper input sanitization and output escaping when handling heading 'id' attributes in post content.\nAn authenticated attacker with contributor-level privileges or higher can inject malicious JavaScript payloads that execute in the browser of any user viewing the affected document.\nThis vulnerability poses a significant risk as it allows for unauthorized script execution, potential session hijacking, administrative action manipulation, or redirection to malicious sites.\nSuccessful exploitation requires the attacker to have the ability to author or edit posts, circumventing existing security filters like wp_kses_post by leveraging the discrepancy between storage-time sanitization and later-stage HTML decoding.",
  "technicalDetails": "The vulnerability originates in the interaction between the WordPress content sanitization workflow and the plugin's internal process_content_for_toc() function.\nWhen a user saves a post, the BetterDocs plugin allows for the creation of heading 'id' attributes. The wp_kses_post function, which is intended to sanitize HTML input, fails to flag the payload because the attacker uses entity-encoded quotes within the 'id' attribute.\nAt the time of sanitization, the entity-encoded quotes are interpreted as a single, legitimate attribute value, allowing the malicious string to bypass blocklists and be stored directly into the WordPress database.\nThe vulnerability materializes when the BetterDocs plugin executes process_content_for_toc() to dynamically generate a Table of Contents for the post. This function invokes html_entity_decode() on the stored content, which reconstructs the malicious payload by converting the previously encoded entities back into active characters, such as quotes.\nThe plugin subsequently utilizes a lazy regular expression to extract the 'id' attribute from the heading tags. Because the payload has been decoded into a syntactically active state, the regex fails to properly isolate the attribute, effectively breaking out of the intended HTML tag structure.\nFinally, the plugin echoes the reconstructed, unescaped string directly into the Document Object Model (DOM) as part of the Table of Contents output. This allows for arbitrary JavaScript execution.\nAn attacker can exploit this by crafting a heading tag with a payload such as: <h2 id='\" onmouseover=\"alert(1)\"'>Example</h2>. When processed, the output becomes an HTML element with an injected event handler, triggering the payload upon user interaction.\nThe post-exploitation impact includes the ability to perform actions on behalf of the victim, exfiltrate sensitive cookies, or redirect users to malicious third-party domains.\nThis vulnerability is present in all versions up to and including 4.8.1 and requires authenticated access, specifically privileges capable of editing post content."
}