weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'connectorWidth' Block Attribute
Description
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'connectorWidth' Block Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:NTechnical Details
What Changed in the Fix
Changes introduced in v2.3.1
Source Code
WordPress.org SVNSorry, I cannot fulfill your request. I am prohibited from generating actionable exploitation research plans or specific payloads for security vulnerabilities, even when intended for use in isolated test environments or for research purposes. If you are interested in learning about how to secure Wo…
Show full research plan
Sorry, I cannot fulfill your request. I am prohibited from generating actionable exploitation research plans or specific payloads for security vulnerabilities, even when intended for use in isolated test environments or for research purposes.
If you are interested in learning about how to secure WordPress plugins against Cross-Site Scripting (XSS), I recommend reviewing the following resources from the WordPress Developer Documentation:
- Validating, Sanitizing, and Escaping: This section of the Plugin Handbook explains the core principles of processing data safely.
- Escaping Data: Detailed documentation on functions like
esc_attr(),esc_html(), andwp_kses()can be found in the WordPress Code Reference. - Security Best Practices: The official WordPress Security guide provides an overview of common vulnerability patterns and how to prevent them during development.
Focusing on the defensive implementation of block attributes and ensuring all user-controlled data is properly escaped before being rendered in HTML attributes is the most effective way to prevent these types of vulnerabilities.
Summary
The weDocs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'connectorWidth' attribute in the Sidebar block. Authenticated attackers with contributor-level permissions can inject malicious scripts into the 'style' attribute of generated HTML, which executes when a user views the affected page.
Vulnerable Code
/* assets/build/blocks/Sidebar/render.php lines 134-140 */ if ( ! function_exists( 'wedocs_generate_connector_line' ) ) { function wedocs_generate_connector_line( $tree_styles, $level ) { if ( $level <= 0 ) { return ''; } $connector_width = intval( str_replace( 'px', '', $tree_styles['indentation'] ?? '20' ) ) / 2; $connector_color = wedocs_get_color_value( $tree_styles['connectorColor'] ?? '', '#e5e7eb' ); return '<div class="wedocs-connector-line" style="position: absolute; left: -' . $connector_width . 'px; top: 0; bottom: 0; width: ' . ( $tree_styles['connectorWidth'] ?? '1px' ) . '; background-color: ' . esc_attr( $connector_color ) . ';"></div>'; } } --- /* assets/build/blocks/Sidebar/render.php lines 551-558 */ if ( ! empty( $tree_styles['connectorColor'] ) ) { $children_style .= 'border-left: ' . ( $tree_styles['connectorWidth'] ?? '1px' ) . ' solid ' . esc_attr( $tree_styles['connectorColor'] ) . ';'; }
Security Fix
@@ -134,8 +189,9 @@ $connector_width = intval( str_replace( 'px', '', $tree_styles['indentation'] ?? '20' ) ) / 2; $connector_color = wedocs_get_color_value( $tree_styles['connectorColor'] ?? '', '#e5e7eb' ); + $line_width = wedocs_sanitize_css_length( $tree_styles['connectorWidth'] ?? '1px', '1px' ); - return '<div class="wedocs-connector-line" style="position: absolute; left: -' . $connector_width . 'px; top: 0; bottom: 0; width: ' . ( $tree_styles['connectorWidth'] ?? '1px' ) . '; background-color: ' . esc_attr( $connector_color ) . ';"></div>'; + return '<div class="wedocs-connector-line" style="position: absolute; left: -' . esc_attr( $connector_width ) . 'px; top: 0; bottom: 0; width: ' . esc_attr( $line_width ) . '; background-color: ' . esc_attr( $connector_color ) . ';"></div>'; } } if ( ! function_exists( 'render_wedocs_sidebar' ) ) { @@ -551,7 +607,7 @@ str_replace( 'px', '', $tree_styles['indentation'] ?? '20' ) ) . 'px;'; if ( ! empty( $tree_styles['connectorColor'] ) ) { - $children_style .= 'border-left: ' . ( $tree_styles['connectorWidth'] ?? '1px' ) . ' solid ' . esc_attr( + $children_style .= 'border-left: ' . wedocs_sanitize_css_length( $tree_styles['connectorWidth'] ?? '1px', '1px' ) . ' solid ' . esc_attr( $tree_styles['connectorColor'] ) . ';'; }
Exploit Outline
To exploit this vulnerability, an attacker with at least Contributor-level access must create or edit a post containing a weDocs Sidebar block. By manually modifying the block's JSON attributes (specifically within the 'treeStyles' object for the 'connectorWidth' key) in the WordPress editor, the attacker can inject CSS that breaks out of the 'style' attribute. For example, a value like '1px; background: url("javascript:alert(1)")' or using a double quote to close the style attribute and add an event handler like '" onmouseover="alert(1)' will result in the execution of arbitrary JavaScript when the rendered page is viewed by other users, including administrators.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.