Stored Cross-Site Scripting Vulnerability in weDocs Plugin for WordPress
CVE-2026-12734

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Wedocs: Ai Powered Knowledge Base, Docs, Documentation, Wiki & Ai Chatbot
Vendor
CVE Published:
3 July 2026

What is CVE-2026-12734?

The weDocs plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability stemming from improper input validation and inadequate output sanitization in the 'connectorWidth' block attribute. This flaw allows authenticated users with contributor-level access or higher to manipulate the content of pages by injecting malicious scripts. Such attacks can compromise user security, potentially leading to unauthorized access and data exposure whenever affected pages are viewed.

Affected Version(s)

weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot 0 <= 2.3.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wedocs/tags/2....
https://plugins.trac.wordpress.org/browser/wedocs/tags/2....

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

PRISM
.