CVE-2026-12157: BetterDocs <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'blockId' Block Attribute
The BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blockId attribute of the betterdocs/category-slate-layout Gutenberg block in versions up to, and including, 4.5.3. This is due to insufficient input sanitization and output escaping in the CategorySlateLayout::render() method, which echoes the blockId block attribute directly into an HTML class attribute without escattr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the CategorySlateLayout::render() method to apply esc_attr() to the blockId block attribute prior to echoing it into an HTML class attribute so the attribute is properly escaped.
BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor plugin for WordPress CategorySlateLayout::render() output escaping of blockId = escape blockId with esc_attr() before echoing into HTML class attribute
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12157?
The severity of CVE-2026-12157 is medium with a CVSS score of 6.4.
What type of vulnerability is CVE-2026-12157?
CVE-2026-12157 is an authenticated stored cross-site scripting (XSS) vulnerability.
How do I fix CVE-2026-12157?
To fix CVE-2026-12157, update the BetterDocs plugin to version 4.5.4 or later.
Who is affected by CVE-2026-12157?
Users of BetterDocs versions up to and including 4.5.3 are affected by CVE-2026-12157.
What causes the vulnerability in CVE-2026-12157?
CVE-2026-12157 is caused by insufficient input validation in the blockId attribute of the category-slate-layout Gutenberg block.