CVE-2026-75980 Overview
The BetterDocs plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting all versions up to and including 4.8.1. The flaw resides in the Table of Contents (ToC) shortcode logic, which decodes HTML entities in a heading id attribute after wp_kses_post has already sanitized the content. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes when any visitor views the affected page.
Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in the browser of every user viewing a page containing the BetterDocs ToC shortcode, enabling session theft and admin account compromise.
Affected Products
- BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress
- All versions up to and including 4.8.1
- WordPress sites where contributor+ users can author content rendered through the BetterDocs ToC shortcode
Discovery Timeline
- 2026-09-01 - CVE-2026-75980 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-75980
Vulnerability Analysis
The vulnerability is a stored Cross-Site Scripting flaw in the BetterDocs Table of Contents rendering pipeline. Contributor-level authenticated attackers can plant a payload inside a heading id attribute that passes WordPress content sanitization but detonates during ToC generation. The injected script executes in the browser context of every subsequent visitor, including administrators.
Because the attack requires only contributor privileges and the scope changes when the script runs against higher-privileged users, the impact extends to session hijacking, forced administrative actions, and pivoting to further site compromise. The vulnerability is exploitable over the network and requires no user interaction beyond viewing an affected page.
Root Cause
The root cause is an inconsistency between save-time sanitization and render-time processing. At save time, wp_kses_post inspects the raw heading markup and sees entity-encoded quotes inside the id attribute as a single legitimate attribute value, allowing the content to persist. At render time, process_content_for_toc() calls html_entity_decode() on the stored content, which reconstitutes the quotes and breaks the attribute boundary. A permissive regex then extracts the malformed id and passes it into the ToC view (views/shortcodes/toc.php) where it is echoed unescaped into the HTML output.
Attack Vector
An authenticated contributor authors a page or post that includes a heading with a crafted id attribute containing HTML-encoded quote characters and a JavaScript payload. After the content is stored, any page load that triggers the BetterDocs ToC shortcode invokes the decode-then-extract pipeline. The decoded payload escapes attribute context and is emitted verbatim into the ToC markup, executing as script in the visitor's browser. See the Wordfence Vulnerability Analysis and the WordPress BetterDocs ToC Component source for the vulnerable code path.
Detection Methods for CVE-2026-75980
Indicators of Compromise
- Post or page content containing heading tags with id attributes that include HTML-encoded quote entities such as " or " followed by event handler attributes like onerror, onclick, or onmouseover.
- Unexpected <script> tags or inline event handlers appearing in rendered ToC output when viewing pages that use the BetterDocs [betterdocs_toc] shortcode.
- New or modified posts authored by contributor-level accounts that contain complex heading markup inconsistent with normal editorial patterns.
Detection Strategies
- Query the wp_posts table for post_content values matching heading patterns with encoded quotes inside id attributes and inspect any matches manually.
- Monitor web server access logs for outbound requests to unfamiliar domains originating from authenticated administrator sessions shortly after viewing content pages.
- Review the BetterDocs plugin version across managed WordPress deployments and flag any instance at or below 4.8.1.
Monitoring Recommendations
- Enable logging of contributor and author account content submissions and review changes to published documentation pages.
- Deploy a Content Security Policy (CSP) that restricts inline script execution and forward CSP violation reports to a centralized SIEM.
- Alert on new administrator sessions or privilege changes that follow content-viewing activity by admin accounts.
How to Mitigate CVE-2026-75980
Immediate Actions Required
- Update the BetterDocs plugin to a version released after 4.8.1 that includes the fix referenced in the WordPress BetterDocs Changeset.
- Audit all existing posts and pages authored by contributor-level accounts for heading markup containing encoded quote entities inside id attributes.
- Restrict contributor and author privileges to trusted personnel and require multi-factor authentication for all WordPress accounts with content creation permissions.
Patch Information
The vendor addressed the issue in the version following 4.8.1. The relevant commit is available in the WordPress BetterDocs Changeset. Site operators should apply the update through the WordPress plugin manager and verify the installed version reflects the patched release.
Workarounds
- Temporarily disable the BetterDocs plugin on sites where an update cannot be applied immediately.
- Remove the [betterdocs_toc] shortcode from published pages until patching is complete to prevent the vulnerable render path from executing.
- Downgrade contributor and author accounts to subscriber where feasible, eliminating the ability to publish content that reaches the vulnerable ToC processor.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
