The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot WordPress plugin is vulnerable to stored cross-site scripting (CWE-79) via the 'connectorWidth' block attribute in all versions up to and including 2.3.0. Authenticated attackers with contributor or higher privileges can inject arbitrary web scripts due to insufficient input sanitization and output escaping. These scripts execute in the context of users who access the compromised pages, potentially leading to session hijacking or other script-based attacks. No official patch or remediation level has been provided as of the publication date.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable attribute. These scripts execute in the browsers of users who view the infected pages, potentially compromising user sessions or performing unauthorized actions within the context of the affected site. The vulnerability does not affect availability but impacts confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the vulnerable 'connectorWidth' block attribute if possible. Monitor for plugin updates from the vendor addressing this issue.