WordPress Plugin Vulnerabilities

BetterDocs < 1.9.0 - Reflected Cross-Site Scripting

Description

The plugin does not escape the tag_ID before outputting it back in the edit category page of the admin dashboard, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

Affects Plugins

Plugin icon
betterdocs
Fixed in 1.9.0

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
396124e9-d6ef-46dd-a245-39db39054e51

Timeline

Publicly Published
2021-09-20 (about 4 years ago)
Added
2021-09-20 (about 4 years ago)
Last Updated
2021-09-20 (about 4 years ago)

Other

Published
Title
Published
2025-04-11
Title
Nepali Date Converter < 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-04-19
Title
Help Desk WP <= 1.2.0 - Editor+ Stored XSS
Published
2025-04-01
Title
Eventbee RSVP Widget <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-11-11
Title
Easy Email Subscription < 1.3.1 - Unauthenticated Stored Cross-Site Scripting
Published
2024-11-12
Title
Sailthru Triggermail < 1.1 - Subscriber+ Stored XSS