Security Alert Summary
The BetterDocs WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in an AI-generated documentation summary feature. The plugin did not sanitise AI-generated summaries before storing and outputting them, and the generation feature is exposed to unauthenticated users. An attacker can store a malicious payload via prompt injection that executes in the browser of any visitor who views the affected page, including administrators.
CVE Details
- CVE ID:
CVE-2026-11371 - Affected component: BetterDocs WordPress plugin
- Affected versions: Versions less than 4.5.5 (JSON includes an example entry: 4.0.0)
- Published: July 16, 2026 at 7:16:46 AM (UTC)
- Last modified: July 16, 2026 at 1:43:05 PM (UTC)
- CVSS v3.1: Base score 6.1, MEDIUM; Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: No privileges required (PR:N); user interaction required (UI:R)
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The plugin does not sanitise an AI-generated documentation summary before storing and outputting it. The summary generation feature is exposed to unauthenticated users, allowing an attacker to provide crafted prompt input (prompt injection) that results in a stored payload. When a visitor views the affected documentation page, the stored payload can execute in the visitor’s browser.
This behavior corresponds to a stored cross-site scripting condition: user-controllable content is saved by the application and later rendered without adequate output encoding or sanitization. The CVE description indicates the vulnerability can affect any visitor who views the page, including administrative users, allowing client-side script execution in their browsers.
How This Could Impact Your Website
In a typical WordPress site with multiple users, an unauthenticated attacker could store a malicious summary that executes when staff or contractors view the associated documentation page. For example, a site owner or administrator viewing the page could have attacker-supplied script run in their browser. External contractors or contributors who review documentation could also trigger the payload.
Practical consequences include exposure of internal user data presented to the browser (such as email addresses visible on pages or in admin interfaces), session-level actions performed in the context of an authenticated user, and an increased risk of targeted phishing or social engineering using information harvested via the injected script. The CVSS impacts indicate limited confidentiality and integrity effects and no direct availability impact, so the vulnerability should be treated as a client-side stored XSS risk rather than guaranteed full site compromise.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level access and any accounts that can trigger documentation generation.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins that increase your attack surface.
- Monitor site activity and logs for unusual behavior, especially changes to documentation pages or stored content fields.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
