WordPress Plugin Vulnerabilities

BetterDocs 1.9.0-1.9.1 - Reflected Cross-Site Scripting

Description

The plugin does not escape the date_range parameter before outputting it back in the All docs admin dashboard, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

Affects Plugins

Plugin icon
betterdocs
Fixed in 1.9.2

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
5aee3b0b-3c93-4b18-86d4-ee1634d37dd1

Timeline

Publicly Published
2021-09-20 (about 4 years ago)
Added
2021-09-20 (about 4 years ago)
Last Updated
2021-09-20 (about 4 years ago)

Other

Published
Title
Published
2025-09-09
Title
My Tickets < 2.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-11-29
Title
Client Dash <= 2.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Published
2025-03-24
Title
Cazamba <= 1.2 - Reflected Cross-Site Scripting
Published
2021-10-04
Title
BP Better Messages < 1.9.9.41 - Reflected Cross-Site Scripting
Published
2025-08-14
Title
Real Estate Manager Pro < 12.7.4 - Reflected Cross-Site Scripting