CVE-2026-12734 is a stored cross-site scripting vulnerability in the weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot WordPress plugin. The issue exists in all versions up to and including 2.3.0 due to improper neutralization of input in the 'connectorWidth' block attribute. Authenticated attackers with contributor or higher privileges can inject arbitrary web scripts that execute in the context of users visiting the compromised pages. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the contributor level.

Successful exploitation allows an authenticated contributor or higher to inject and execute arbitrary JavaScript in the context of other users viewing the affected pages. This can lead to information disclosure and limited integrity impact but does not affect availability. The vulnerability could be used to hijack user sessions or perform actions on behalf of users with lower privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin if possible. Monitor vendor channels for updates and apply patches promptly once released.