CVE-2026-75980

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives wp_kses_post because entity-encoded quotes in a heading id attribute are treated as a single legitimate attribute value at save time; the dangerous payload only materialises after process_content_for_toc() calls html_entity_decode() on the stored content and the broken id is extracted by a lazy regex before being echoed unescaped into the Table of Contents output.

• CWE-79

• https://plugins.trac.wordpress.org/browser/betterdocs/tags/4.8.1/includes/Shortcodes/ToC.php#L147
• https://plugins.trac.wordpress.org/browser/betterdocs/tags/4.8.1/includes/Shortcodes/ToC.php#L75
• https://plugins.trac.wordpress.org/browser/betterdocs/tags/4.8.1/includes/Utils/Node.php#L22
• https://plugins.trac.wordpress.org/browser/betterdocs/tags/4.8.1/views/shortcodes/toc.php#L50
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3656697%40betterdocs&new=3656697%40betterdocs
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d1305df9-5002-4352-875c-2dcba7b06c10?source=cve

Published

Sep 1, 2026

Last Modified

Sep 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75975fast-uri is a URI parser for Node.js. Its custom parser for …7.5
• CVE-2026-75976A weakness has been identified in TRENDnet TEW-823DRU 1.1.02…9.9
• CVE-2026-75977The Mang Board WP plugin for WordPress is vulnerable to Miss…8.8
• CVE-2026-75978A security vulnerability has been detected in xianrendzw Eas…6.3
• CVE-2026-75979A vulnerability was found in xianrendzw EasyReport up to 2.0…6.3
• CVE-2026-7598A security vulnerability has been detected in libssh2 up to …7.3
• CVE-2026-75981The TranslatePress – Translate Multilingual sites with AI Tr…7.2
• CVE-2026-75982The LearnPress plugin for WordPress is vulnerable to unautho…4.4
• CVE-2026-75984A vulnerability was detected in TRENDnet TEW-823DRU 1.1.02b0…7.4
• CVE-2026-75985A flaw has been found in TRENDnet Router 1.1.02b01. The affe…7.4
• CVE-2026-75986A vulnerability has been found in code-projects Online Job P…7.3
• CVE-2026-75987A vulnerability was found in SPLWare esProc up to 20260507. …7.3