Cross-Site Scripting
6 records42.9%First: 2024. Latest: 2026.
Plugin security history
BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 14 vulnerability records associated with BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot, published between 2023 and 2026.
Dataset last synchronized: 2026-08-02 09:41:47 UTC
At a glance
Security Snapshot
14Total records
1Critical
2High
11Medium
0Low
0Informational
14Patched records
0Currently marked unpatched
2023-11-13First disclosure
2026-07-24Latest disclosure
14 of 14CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2023 | 1 | |
| 2024 | 4 | |
| 2025 | 1 | |
| 2026 | 8 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 1 | 7.1% |
| High | 2 | 14.3% |
| Medium | 11 | 78.6% |
Vulnerability-Type Breakdown
Missing Authorization
3 records21.4%First: 2023. Latest: 2026.
Other
2 records14.3%First: 2024. Latest: 2024.
Information Disclosure
2 records14.3%First: 2026. Latest: 2026.
SQL Injection
1 record7.1%First: 2026. Latest: 2026.
Patch Status
- Patched
- 14
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
4.7.04.6.14.5.54.5.44.3.124.3.94.3.114.3.44.1.23.5.93.3.43.5.02.5.3
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-4.6.2 | BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting | July 24, 2026 | 4.7.0 | Medium |
*-4.6.0 | BetterDocs <= 4.6.0 - Authenticated (Custom+) SQL Injection via 'lang' Parameter | July 9, 2026 | 4.6.1 | Medium |
*-4.5.4 | BetterDocs <= 4.5.4 - Unauthenticated Stored Cross-Site Scripting | June 25, 2026 | 4.5.5 | High |
*-4.5.3 | BetterDocs <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'blockId' Block Attribute | June 18, 2026 | 4.5.4 | Medium |
*-4.3.11 | BetterDocs <= 4.3.11 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usage | April 23, 2026 | 4.3.12 | Medium |
*-4.3.8 | BetterDocs <= 4.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | April 15, 2026 | 4.3.9 | Medium |
*-4.3.10 | BetterDocs <= 4.3.10 - Unauthenticated Information Exposure | March 18, 2026 | 4.3.11 | Medium |
*-4.3.3 | BetterDocs <= 4.3.3 - Authenticated (Contributor+) Sensitive Information Exposure | January 8, 2026 | 4.3.4 | Medium |
*-4.1.1 | BetterDocs <= 4.1.1 - Missing Authorization to Private And Password-Protected Posts Information Disclosure | August 15, 2025 | 4.1.2 | Medium |
*-3.5.8 | BetterDocs <= 3.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting | August 9, 2024 | 3.5.9 | Medium |
*-3.5.8 | BetterDocs <= 3.5.8 - Authenticated (Contributor+) Local File Inclusion | August 7, 2024 | 3.5.9 | High |
*-3.3.3 | BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer for Elementor & Gutenberg <= 3.3.3 - Unauthenticated PHP Object Injection | March 26, 2024 | 3.3.4 | Critical |
*-3.4.2 | BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | March 25, 2024 | 3.5.0 | Medium |
*-2.5.2 | BetterDocs <= 2.5.2 - Missing Authorization via AJAX actions | November 13, 2023 | 2.5.3 | Medium |
Selected source records
Latest Records
MediumCVE-2026-65562
BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: July 24, 2026
- Affected versions
- *-4.6.2
- Patched versions
- 4.7.0
MediumCVE-2026-15104
BetterDocs <= 4.6.0 - Authenticated (Custom+) SQL Injection via 'lang' Parameter
Published: July 9, 2026
- Affected versions
- *-4.6.0
- Patched versions
- 4.6.1
HighCVE-2026-11371
BetterDocs <= 4.5.4 - Unauthenticated Stored Cross-Site Scripting
Published: June 25, 2026
- Affected versions
- *-4.5.4
- Patched versions
- 4.5.5
MediumCVE-2026-12157
BetterDocs <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'blockId' Block Attribute
Published: June 18, 2026
- Affected versions
- *-4.5.3
- Patched versions
- 4.5.4
MediumCVE-2026-6393
BetterDocs <= 4.3.11 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usage
Published: April 23, 2026
- Affected versions
- *-4.3.11
- Patched versions
- 4.3.12
MediumCVE-2026-3875
BetterDocs <= 4.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Published: April 15, 2026
- Affected versions
- *-4.3.8
- Patched versions
- 4.3.9
MediumCVE-2026-42644
BetterDocs <= 4.3.10 - Unauthenticated Information Exposure
Published: March 18, 2026
- Affected versions
- *-4.3.10
- Patched versions
- 4.3.11
MediumCVE-2025-14980
BetterDocs <= 4.3.3 - Authenticated (Contributor+) Sensitive Information Exposure
Published: January 8, 2026
- Affected versions
- *-4.3.3
- Patched versions
- 4.3.4
Highest-Severity Records
CriticalCVE-2024-30226
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer for Elementor & Gutenberg <= 3.3.3 - Unauthenticated PHP Object Injection
Published: March 26, 2024
- Affected versions
- *-3.3.3
- Patched versions
- 3.3.4
HighCVE-2024-43129
BetterDocs <= 3.5.8 - Authenticated (Contributor+) Local File Inclusion
Published: August 7, 2024
- Affected versions
- *-3.5.8
- Patched versions
- 3.5.9
HighCVE-2026-11371
BetterDocs <= 4.5.4 - Unauthenticated Stored Cross-Site Scripting
Published: June 25, 2026
- Affected versions
- *-4.5.4
- Patched versions
- 4.5.5
MediumCVE-2026-15104
BetterDocs <= 4.6.0 - Authenticated (Custom+) SQL Injection via 'lang' Parameter
Published: July 9, 2026
- Affected versions
- *-4.6.0
- Patched versions
- 4.6.1
MediumCVE-2025-14980
BetterDocs <= 4.3.3 - Authenticated (Contributor+) Sensitive Information Exposure
Published: January 8, 2026
- Affected versions
- *-4.3.3
- Patched versions
- 4.3.4
MediumCVE-2024-2845
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published: March 25, 2024
- Affected versions
- *-3.4.2
- Patched versions
- 3.5.0
MediumCVE-2026-65562
BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: July 24, 2026
- Affected versions
- *-4.6.2
- Patched versions
- 4.7.0
MediumCVE-2026-3875
BetterDocs <= 4.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Published: April 15, 2026
- Affected versions
- *-4.3.8
- Patched versions
- 4.3.9
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.