Plugin icon

BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot

betterdocs

Vulnerabilities:

14

Last Updated:

June 23, 2026

Active Installs:

30000

Published
Title
Fixed in
CVSS
Published
2026-06-25
Title
BetterDocs < 4.5.5 - Unauthenticated Stored XSS via AI Doc Summarizer Prompt Injection
Fixed in
Fixed in 4.5.5
CVSS
8.8 (high)
Published
2026-06-18
Title
BetterDocs < 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'blockId' Block Attribute
Fixed in
Fixed in 4.5.4
CVSS
5.5 (medium)
Published
2026-04-23
Title
BetterDocs < 4.3.12 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usage
Fixed in
Fixed in 4.3.12
CVSS
4.3 (medium)
Published
2026-04-15
Title
BetterDocs < 4.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Fixed in
Fixed in 4.3.9
CVSS
5.5 (medium)
Published
2026-03-18
Title
BetterDocs < 4.3.11 - Unauthenticated Information Exposure
Fixed in
Fixed in 4.3.11
CVSS
5.3 (medium)
Published
2026-01-08
Title
BetterDocs < 4.3.4 - Authenticated (Contributor+) Sensitive Information Exposure
Fixed in
Fixed in 4.3.4
CVSS
6.5 (medium)
Published
2025-08-15
Title
BetterDocs < 4.1.2 - Missing Authorization to Private And Password-Protected Posts Information Disclosure
Fixed in
Fixed in 4.1.2
CVSS
5.3 (medium)
Published
2024-08-09
Title
BetterDocs < 3.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.5.9
CVSS
6.4 (medium)
Published
2024-08-07
Title
BetterDocs < 3.5.9 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 3.5.9
CVSS
8.8 (high)
Published
2024-03-26
Title
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer for Elementor & Gutenberg < 3.3.4 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 3.3.4
CVSS
9.8 (critical)
Published
2024-03-25
Title
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg < 3.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 3.5.0
CVSS
6.4 (medium)
Published
2023-11-13
Title
BetterDocs < 2.5.3 - Missing Authorization via AJAX actions
Fixed in
Fixed in 2.5.3
CVSS
4.3 (medium)
Published
2021-09-20
Title
BetterDocs < 1.9.0 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.9.0
CVSS
8.8 (high)
Published
2021-09-20
Title
BetterDocs 1.9.0-1.9.1 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.9.2
CVSS
8.8 (high)