Executive brief
The BetterDocs WordPress plugin, used to create documentation and knowledge bases, contains a stored cross-site scripting vulnerability in the Table of Contents feature. Authenticated users with contributor-level access can inject malicious scripts into page headings that execute for all visitors viewing those pages, potentially compromising user data or enabling account takeover.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the BetterDocs plugin's Table of Contents generation. The root cause lies in insufficient input sanitization and output escaping: entity-encoded quotes in heading id attributes bypass wp_kses_post() validation at save time, appearing as legitimate attribute values. When process_content_for_toc() calls html_entity_decode() on stored content and extracts the id via a regex, the payload is decoded and echoed unescaped into the Table of Contents output. The attack requires authentication with contributor-level or higher privileges. All versions up to and including 4.8.1 are affected. Attackers can inject arbitrary JavaScript that persists on affected pages and executes in the browsers of all visitors.
Affected products
- BetterDocs BetterDocs up to and including 4.8.1
Timeline
- 2026-09-01: disclosed