The BetterDocs WordPress plugin prior to version 4.5.5 contains a stored XSS vulnerability (CWE-79) due to improper sanitization of an AI-generated documentation summary. Because the feature generating this summary is exposed to unauthenticated users, attackers can submit crafted input that results in malicious script execution in the context of any user viewing the page, including privileged users. This vulnerability arises from the lack of input validation and output encoding in the plugin's handling of AI-generated content.

An attacker can inject malicious JavaScript code that executes in the browsers of users visiting the affected documentation pages. This can lead to session hijacking, privilege escalation, or other malicious actions performed with the privileges of the victim user, including administrators. The vulnerability affects the confidentiality and integrity of user sessions and data within the WordPress environment using the affected plugin version.

No official patch or remediation is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates and apply any official fixes once available. Until then, consider disabling the AI-generated documentation summary feature or restricting access to it if possible to reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.