Stored Cross-Site Scripting Vulnerability in weDocs Plugin for WordPress
CVE-2026-104760

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Wedocs: Ai Powered Knowledge Base, Docs, Documentation, Wiki & Ai Chatbot
Vendor
CVE Published:
7 November 2026

What is CVE-2026-104760?

The weDocs plugin for WordPress suffers from a Stored Cross-Site Scripting issue due to inadequate sanitization of the 'modalPlaceholder' block attribute. This vulnerability allows authenticated users with contributor-level access or higher to insert malicious web scripts. Such scripts trigger in the browsers of administrators or editors who view or preview the affected pages, potentially compromising sensitive information or leading to site exploitation. All versions up to and including 2.6.1 are affected, which underscores the need for immediate attention to input validation and output encoding measures.

Affected Version(s)

weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot 0 <= 2.6.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wedocs/tags/2....
https://plugins.trac.wordpress.org/browser/wedocs/tags/2....

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.