Vulnerabilities and security researches forbetterdocs betterdocs
Direction: descendingJun 19, 2026
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support # CVE-2026-12157
- CVE, Research URL
- Home page URL
- Date
- Jun 19, 2026
- Research Description
- The BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blockId attribute of the betterdocs/category-slate-layout Gutenberg block in versions up to, and including, 4.5.3. This is due to insufficient input sanitization and output escaping in the CategorySlateLayout::render() method, which echoes the blockId block attribute directly into an HTML class attribute without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
max 4.5.4.
- Status
-
vulnerable
Jun 16, 2026
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support # 5aee3b0b-3c93-4b18-86d4-ee1634d37dd1
- CVE, Research URL
- Home page URL
- Date
- -
- Research Description
- BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot [betterdocs] >= 1.9.0 - <= 1.9.1 BetterDocs 1.9.0-1.9.1 - Reflected Cross-Site Scripting The plugin does not escape the date_range parameter before outputting it back in the All docs admin dashboard, leading to a Reflected Cross-Site Scripting issue
- Affected versions
-
Min 1.9.0, max 1.9.1.
- Status
-
vulnerable
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support # d82c57693fa37786130fe02fd3cfd7b31e04b599
- CVE, Research URL
- Home page URL
- Date
- Sep 10, 2021
- Research Description
- BetterDocs – AI Documentation, Knowledge Base, Docs, FAQ with Chatbot [betterdocs] < 1.9.0 WordPress BetterDocs plugin <= 1.8.4 - Reflected Cross-Site Scripting (XSS) vulnerability Reflected Cross-Site Scripting (XSS) vulnerability discovered by WPScanTeam in WordPress BetterDocs plugin (versions <= 1.8.4).
- Affected versions
-
max 1.9.0.
- Status
-
vulnerable
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support # 396124e9-d6ef-46dd-a245-39db39054e51
- CVE, Research URL
- Home page URL
- Date
- -
- Research Description
- BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot [betterdocs] < 1.9.0 BetterDocs < 1.9.0 - Reflected Cross-Site Scripting The plugin does not escape the tag_ID before outputting it back in the edit category page of the admin dashboard, leading to a Reflected Cross-Site Scripting issue
- Affected versions
-
max 1.9.0.
- Status
-
vulnerable
May 01, 2026
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support # CVE-2026-42644
- CVE, Research URL
- Home page URL
- Date
- Apr 29, 2026
- Research Description
- Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper BetterDocs betterdocs allows Retrieve Embedded Sensitive Data.This issue affects BetterDocs: from n/a through <= 4.3.10.
- Affected versions
-
max 4.3.11.
- Status
-
vulnerable
Apr 25, 2026
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support # CVE-2026-6393
- CVE, Research URL
- Home page URL
- Date
- Apr 24, 2026
- Research Description
- The BetterDocs plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.3.11. This is due to a missing capability check in the generate_openai_content_callback() function, which relies solely on a nonce rather than verifying user permissions. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger OpenAI API calls using the site's configured API key with arbitrary user-controlled prompts, leading to unauthorized consumption of the site owner's paid AI API quota.
- Affected versions
-
max 4.3.12.
- Status
-
vulnerable
Apr 17, 2026
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support # CVE-2026-3875
- CVE, Research URL
- Home page URL
- Date
- Apr 16, 2026
- Research Description
- The BetterDocs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'betterdocs_feedback_form' shortcode in all versions up to, and including, 4.3.8. This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
max 4.3.9.
- Status
-
vulnerable
Jan 11, 2026
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support # CVE-2025-14980
- CVE, Research URL
- Home page URL
- Date
- Jan 09, 2026
- Research Description
- The BetterDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.3 via the scripts() function. This makes it possible for authenticated attackers, with contributor-level access and above, to extract sensitive data including the OpenAI API key stored in plugin settings.
- Affected versions
-
max 4.3.4.
- Status
-
vulnerable
Aug 17, 2025
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support # CVE-2025-7499
- CVE, Research URL
- Home page URL
- Date
- Aug 16, 2025
- Research Description
- The BetterDocs – Advanced AI-Driven Documentation, FAQ & Knowledge Base Tool for Elementor & Gutenberg with Encyclopedia, AI Support, Instant Answers plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_response function in all versions up to and including 4.1.1. This makes it possible for unauthenticated attackers to retrieve passwords for password-protected documents as well as the metadata of private and draft documents.
- Affected versions
-
max 4.1.2.
- Status
-
vulnerable
Aug 13, 2024
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support # CVE-2024-43227
- CVE, Research URL
- Home page URL
- Date
- Aug 13, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPDeveloper BetterDocs allows Stored XSS.This issue affects BetterDocs: from n/a through 3.5.8.
- Affected versions
-
max 3.5.9.
- Status
-
vulnerable
Aug 11, 2024
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support # CVE-2024-43129
- CVE, Research URL
- Home page URL
- Date
- Aug 13, 2024
- Research Description
- Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPDeveloper BetterDocs allows PHP Local File Inclusion.This issue affects BetterDocs: from n/a through 3.5.8.
- Affected versions
-
max 3.5.9.
- Status
-
vulnerable
Jun 10, 2024
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support # CVE-2023-47762
- CVE, Research URL
- Home page URL
- Date
- Dec 09, 2024
- Research Description
- Missing Authorization vulnerability in WPDeveloper BetterDocs betterdocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BetterDocs: from n/a through <= 2.5.2.
- Affected versions
-
max 2.5.3.
- Status
-
vulnerable
Jun 07, 2024
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support # 570a5ea4283ba5eedfe576e20fa6580f667ce12b
- CVE, Research URL
- Home page URL
- Date
- Sep 20, 2021
- Research Description
- BetterDocs – AI Documentation, Knowledge Base, Docs, FAQ with Chatbot [betterdocs] < 1.9.2 WordPress BetterDocs plugin <= 1.9.1 - Reflected Cross-Site Scripting (XSS) vulnerability Reflected Cross-Site Scripting (XSS) vulnerability discovered by WPScanTeam in WordPress BetterDocs plugin (versions <= 1.9.1).
- Affected versions
-
Min 1.9.0, max 1.9.2.
- Status
-
vulnerable
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support # CVE-2024-2845
- CVE, Research URL
- Home page URL
- Date
- Apr 10, 2024
- Research Description
- The BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
max 3.5.0.
- Status
-
vulnerable
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support # CVE-2024-30226
- CVE, Research URL
- Home page URL
- Date
- Mar 28, 2024
- Research Description
- Deserialization of Untrusted Data vulnerability in WPDeveloper BetterDocs.This issue affects BetterDocs: from n/a through 3.3.3.
- Affected versions
-
max 3.3.4.
- Status
-
vulnerable