Wedocs Vulnerabilities

The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'connectorWidth' Block Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenti...

CVSS:

6.4

Affected:

up to 2.3.0

Fixed in:

2.3.1

Disclosed:

Jul 2, 2026

CVE-2026-12734 on NVD →

The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.3.0. This is due to a missing capability check on the do_migration() function registered as the wedocs_migrate_betterdocs_to_wedocs AJAX action, whi...

CVSS:

4.3

Affected:

up to 2.3.0

Fixed in:

2.3.1

Disclosed:

Jul 2, 2026

CVE-2026-12729 on NVD →

The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes...

CVSS:

6.4

Affected:

up to 2.3.0

Fixed in:

2.3.1

Disclosed:

Jul 2, 2026

CVE-2026-12731 on NVD →

The weDocs plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.1.18. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 2.1.18

Fixed in:

2.2.1

Disclosed:

Feb 25, 2026

CVE-2026-39520 on NVD →

The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to unauthorized modification or loss of data due to a missing capability check on the 'wedocs_user_documentation_handling_capabilities' function in all versions up to, and including, 2.1.16. This makes it po...

CVSS:

4.3

Affected:

up to 2.1.16

Fixed in:

2.1.17

Disclosed:

Jan 22, 2026

CVE-2025-13921 on NVD →

The weDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.15 via the `/wp-json/wp/v2/docs/settings` REST API endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including third party services API keys.

CVSS:

5.3

Affected:

up to 2.1.15

Fixed in:

2.1.16

Disclosed:

Jan 8, 2026

CVE-2025-14574 on NVD →

The weDocs plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.1.14. This is due to the plugin not properly verifying that a user is authorized to perform an action in the create_item_permissions_check function. This makes it possible for authenticated attackers, with Subsc...

CVSS:

5.4

Affected:

up to 2.1.14

Fixed in:

2.1.15

Disclosed:

Dec 5, 2025

CVE-2025-12505 on NVD →

The weDocs plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_helpfullness REST API endpoint in versions up to, and including, 2.1.4. This makes it possible for unauthenticated attackers to update settings.

CVSS:

5.3

Affected:

up to 2.1.4

Fixed in:

2.1.5

Disclosed:

May 7, 2024

CVE-2024-34442 on NVD →

The Appsero analytics tool used in several plugins is vulnerable to authorization bypass due to a missing capability check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with subscriber-level permissio...

CVSS:

4.3

Affected:

1.6 – 1.7.5

Fixed in:

1.7.6

Disclosed:

Dec 16, 2022

The Appsero analytics tool used in several plugins is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to invoke this function inten...

CVSS:

4.3

Affected:

1.6 – 1.7.5

Fixed in:

1.7.6

Disclosed:

Dec 14, 2022

CVE-2022-47150 on NVD →