Stored Cross-Site Scripting in BetterDocs Plugin for WordPress

CVE-2026-75980

What is CVE-2026-75980?

The BetterDocs plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability caused by inadequate input sanitization and output escaping for the 'id' attribute of headings in post content. Authenticated attackers with contributor-level access can inject harmful web scripts into pages. This exploit bypasses standard security measures, such as wp_kses_post, as entity-encoded quotes are interpreted as valid attribute values at the time of saving. Consequently, when the content is processed, the injected payload can be executed whenever a user accesses the affected page, allowing the attacker to potentially gain further access or compromise user data.

References