CVE-2026-3875 is a stored cross-site scripting vulnerability in the BetterDocs – Knowledge Base Docs & FAQ Solution for Elementor & Block Editor WordPress plugin. The issue arises from improper neutralization of user-supplied input in the 'betterdocs_feedback_form' shortcode attributes, allowing authenticated users with contributor-level access or higher to inject arbitrary web scripts. These scripts are stored and executed when other users access the injected pages. The vulnerability affects all versions up to and including 4.3.8. The CVSS 3.1 base score is 6.4, reflecting a network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity but not availability.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, which execute in the context of users viewing those pages. This can lead to unauthorized actions or data disclosure limited to the confidentiality and integrity of the affected site. There is no impact on availability. The vulnerability does not affect unauthenticated users directly and requires contributor-level privileges.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the BetterDocs plugin if possible to prevent exploitation.