CVE-2025-6787: Smart Docs WordPress Plugin XSS Vulnerability

CVE-2025-6787 Overview

CVE-2025-6787 is a Stored Cross-Site Scripting (XSS) vulnerability in the Smart Docs plugin for WordPress, developed by Archalj. The flaw affects all plugin versions up to and including 1.1.0. The vulnerability resides in the smartdocs_search shortcode, which fails to properly sanitize user-supplied attributes and escape output. Authenticated attackers with contributor-level permissions or higher can inject arbitrary JavaScript that executes when any user views the affected page. The issue is tracked under CWE-79 and is categorized as a Cross-Site Scripting vulnerability.

Critical Impact
Contributor-level users can inject persistent JavaScript into WordPress pages, enabling session theft, administrative account takeover, and malicious redirects when visitors access the compromised content.

Affected Products

Archalj Smart Docs plugin for WordPress, versions 1.1.0 and earlier
WordPress sites running the smart-docs plugin with contributor or higher roles enabled
All installations exposing the smartdocs_search shortcode

Discovery Timeline

2025-07-04 - CVE-2025-6787 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6787

Vulnerability Analysis

The Smart Docs plugin exposes a shortcode named smartdocs_search that accepts user-controlled attributes. The plugin processes these attributes without sufficient input sanitization and without escaping them during HTML output. When a contributor-level user embeds the shortcode with malicious attribute values in a post or page, the payload is persisted to the WordPress database. Any subsequent visitor who renders the page triggers the injected script in their browser context.

Because the attack requires authenticated access at the contributor tier, exploitation depends on sites that permit user registration or that already provision contributor accounts to multiple authors. The attacker leverages the trust of the WordPress rendering pipeline to run JavaScript against site visitors, including administrators.

Root Cause

The root cause is improper neutralization of input during web page generation. The shortcode handler reads attribute values supplied by the post author and emits them into the HTML response without applying WordPress escaping functions such as esc_attr() or esc_html(). This classic failure to enforce output encoding allows arbitrary HTML and JavaScript to be stored and later executed.

Attack Vector

An attacker with a contributor account authors a post containing the smartdocs_search shortcode and embeds a JavaScript payload inside one of its attributes. The payload is stored in the WordPress wp_posts table. When an editor, administrator, or site visitor views the page, the browser parses the injected markup and executes the attacker's script. The scope change in the CVSS vector reflects that the executed script runs against users beyond the original authentication boundary. Successful exploitation can hijack sessions, perform actions on behalf of administrators, deface pages, or redirect traffic to attacker-controlled infrastructure.

No verified proof-of-concept code is available at this time. Full technical analysis is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-6787

Indicators of Compromise

Posts or pages authored by contributor accounts that contain the [smartdocs_search] shortcode with unusual attribute values
Database entries in wp_posts referencing smartdocs_search with embedded <script>, onerror, onload, or javascript: strings
Outbound requests from site visitors to unexpected third-party domains after loading pages that embed the shortcode

Detection Strategies

Query the WordPress database for shortcode usage with potentially malicious attributes using patterns such as smartdocs_search.*(<|script|onerror|javascript:)
Review web server access logs for anomalous referrers or redirects originating from pages that render the Smart Docs shortcode
Audit the wp_users and wp_usermeta tables for recently created contributor accounts correlated with new post activity

Monitoring Recommendations

Enable WordPress audit logging to track post creation and shortcode usage by non-administrative accounts
Deploy a web application firewall rule set that inspects stored content for script tags before publication
Monitor browser-side telemetry and Content Security Policy violation reports for unexpected inline script execution

How to Mitigate CVE-2025-6787

Immediate Actions Required

Update the Smart Docs plugin to a version later than 1.1.0 once the vendor publishes a patched release
Audit all contributor-level and higher accounts, removing those that are inactive or unverified
Review existing posts for malicious use of the smartdocs_search shortcode and remove injected payloads

Patch Information

The vendor committed changes referenced in the WordPress Plugin Changeset. Administrators should verify the installed plugin version through the WordPress dashboard and upgrade via the official Smart Docs Plugin Page. If no fixed version is yet available for your installation, deactivate and uninstall the plugin until a patch is applied.

Workarounds

Deactivate the Smart Docs plugin until a patched release is confirmed
Restrict post publication rights so that contributor-authored content requires editorial review before being visible to visitors
Implement a strict Content Security Policy that disallows inline scripts and limits permitted script sources
Deploy a web application firewall rule that strips or blocks <script> tags and event-handler attributes submitted through authenticated post endpoints

bash

# Configuration example: disable the plugin via WP-CLI pending a fix
wp plugin deactivate smart-docs
wp plugin uninstall smart-docs

# Audit for shortcode-based injection attempts
wp db query "SELECT ID, post_author, post_title FROM wp_posts \
  WHERE post_content LIKE '%[smartdocs_search%' \
  AND (post_content LIKE '%<script%' OR post_content LIKE '%onerror%' OR post_content LIKE '%javascript:%');"