CVE-2026-75980: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wpdevteam BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to stored cross-site scripting via the heading 'id' attribute in post content in all versions up to and including 4.8.1. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when users access the injected page. The vulnerability exists because entity-encoded quotes in the heading id attribute bypass wp_kses_post sanitization and are decoded by process_content_for_toc(), which uses a regex to extract the id and outputs it unescaped into the Table of Contents, enabling script execution.

An attacker with contributor-level or higher privileges can inject malicious scripts that execute in the context of users viewing the affected pages. This can lead to theft of user credentials, session hijacking, or other actions permitted by the victim's privileges. The vulnerability does not require user interaction beyond viewing the page and does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling the Table of Contents feature if feasible. Monitor vendor communications for updates and apply official patches once released.