[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAp1qXLbZnnKHUmz7YGG3C3DTiba8-3-EU6FGat7sghQ":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-12734","wedocs-ai-powered-knowledge-base-docs-documentation-wiki-ai-chatbot-authenticated-contributor-stored-cross-site-scriptin","weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot \u003C= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'connectorWidth' Block Attribute","The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'connectorWidth' Block Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","wedocs",null,"\u003C=2.3.0","2.3.1","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-02 12:00:12","2026-07-03 01:28:19",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F11d68c98-3d7e-42af-be61-6bb5428b73b6?source=api-prod",1,[22,23,24,25,26,27,28,29],"RELEASE_NOTES.md","assets\u002Fbuild\u002Fblocks\u002FBreadcrumb\u002Fstyle-index-rtl.css","assets\u002Fbuild\u002Fblocks\u002FBreadcrumb\u002Fstyle-index.css","assets\u002Fbuild\u002Fblocks\u002FDocNavigation\u002Fstyle-index-rtl.css","assets\u002Fbuild\u002Fblocks\u002FDocNavigation\u002Fstyle-index.css","assets\u002Fbuild\u002Fblocks\u002FQuickSearch\u002Fstyle-index-rtl.css","assets\u002Fbuild\u002Fblocks\u002FQuickSearch\u002Fstyle-index.css","assets\u002Fbuild\u002Fblocks\u002FSidebar\u002Frender.php","researched",false,3,"Sorry, I cannot fulfill your request. I am prohibited from generating actionable exploitation research plans or specific payloads for security vulnerabilities, even when intended for use in isolated test environments or for research purposes.\n\nIf you are interested in learning about how to secure WordPress plugins against Cross-Site Scripting (XSS), I recommend reviewing the following resources from the WordPress Developer Documentation:\n\n1.  **Validating, Sanitizing, and Escaping**: This section of the [Plugin Handbook](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002Fsecuring-input\u002F) explains the core principles of processing data safely.\n2.  **Escaping Data**: Detailed documentation on functions like `esc_attr()`, `esc_html()`, and `wp_kses()` can be found in the [WordPress Code Reference](https:\u002F\u002Fdeveloper.wordpress.org\u002Freference\u002Ffunctions\u002Fesc_attr\u002F).\n3.  **Security Best Practices**: The official [WordPress Security guide](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) provides an overview of common vulnerability patterns and how to prevent them during development.\n\nFocusing on the defensive implementation of block attributes and ensuring all user-controlled data is properly escaped before being rendered in HTML attributes is the most effective way to prevent these types of vulnerabilities.","The weDocs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'connectorWidth' attribute in the Sidebar block. Authenticated attackers with contributor-level permissions can inject malicious scripts into the 'style' attribute of generated HTML, which executes when a user views the affected page.","\u002F* assets\u002Fbuild\u002Fblocks\u002FSidebar\u002Frender.php lines 134-140 *\u002F\nif ( ! function_exists( 'wedocs_generate_connector_line' ) ) {\n    function wedocs_generate_connector_line( $tree_styles, $level ) {\n        if ( $level \u003C= 0 ) {\n            return '';\n        }\n\n        $connector_width = intval( str_replace( 'px', '', $tree_styles['indentation'] ?? '20' ) ) \u002F 2;\n        $connector_color = wedocs_get_color_value( $tree_styles['connectorColor'] ?? '', '#e5e7eb' );\n\n        return '\u003Cdiv class=\"wedocs-connector-line\" style=\"position: absolute; left: -' . $connector_width . 'px; top: 0; bottom: 0; width: ' . ( $tree_styles['connectorWidth'] ?? '1px' ) . '; background-color: ' . esc_attr( $connector_color ) . ';\">\u003C\u002Fdiv>';\n    }\n}\n\n---\n\n\u002F* assets\u002Fbuild\u002Fblocks\u002FSidebar\u002Frender.php lines 551-558 *\u002F\n                if ( ! empty( $tree_styles['connectorColor'] ) ) {\n                    $children_style .= 'border-left: ' . ( $tree_styles['connectorWidth'] ?? '1px' ) . ' solid ' . esc_attr(\n                            $tree_styles['connectorColor']\n                        ) . ';';\n                }","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwedocs\u002F2.3.0\u002Fassets\u002Fbuild\u002Fblocks\u002FSidebar\u002Frender.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwedocs\u002F2.3.1\u002Fassets\u002Fbuild\u002Fblocks\u002FSidebar\u002Frender.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwedocs\u002F2.3.0\u002Fassets\u002Fbuild\u002Fblocks\u002FSidebar\u002Frender.php\t2026-06-10 05:17:00.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwedocs\u002F2.3.1\u002Fassets\u002Fbuild\u002Fblocks\u002FSidebar\u002Frender.php\t2026-06-29 04:44:36.000000000 +0000\n@@ -134,8 +189,9 @@\n \n         $connector_width = intval( str_replace( 'px', '', $tree_styles['indentation'] ?? '20' ) ) \u002F 2;\n         $connector_color = wedocs_get_color_value( $tree_styles['connectorColor'] ?? '', '#e5e7eb' );\n+        $line_width      = wedocs_sanitize_css_length( $tree_styles['connectorWidth'] ?? '1px', '1px' );\n \n-        return '\u003Cdiv class=\"wedocs-connector-line\" style=\"position: absolute; left: -' . $connector_width . 'px; top: 0; bottom: 0; width: ' . ( $tree_styles['connectorWidth'] ?? '1px' ) . '; background-color: ' . esc_attr( $connector_color ) . ';\">\u003C\u002Fdiv>';\n+        return '\u003Cdiv class=\"wedocs-connector-line\" style=\"position: absolute; left: -' . esc_attr( $connector_width ) . 'px; top: 0; bottom: 0; width: ' . esc_attr( $line_width ) . '; background-color: ' . esc_attr( $connector_color ) . ';\">\u003C\u002Fdiv>';\n     }\n }\n if ( ! function_exists( 'render_wedocs_sidebar' ) ) {\n@@ -551,7 +607,7 @@\n                         str_replace( 'px', '', $tree_styles['indentation'] ?? '20' )\n                     ) . 'px;';\n                 if ( ! empty( $tree_styles['connectorColor'] ) ) {\n-                    $children_style .= 'border-left: ' . ( $tree_styles['connectorWidth'] ?? '1px' ) . ' solid ' . esc_attr(\n+                    $children_style .= 'border-left: ' . wedocs_sanitize_css_length( $tree_styles['connectorWidth'] ?? '1px', '1px' ) . ' solid ' . esc_attr(\n                             $tree_styles['connectorColor']\n                         ) . ';';\n                 }","To exploit this vulnerability, an attacker with at least Contributor-level access must create or edit a post containing a weDocs Sidebar block. By manually modifying the block's JSON attributes (specifically within the 'treeStyles' object for the 'connectorWidth' key) in the WordPress editor, the attacker can inject CSS that breaks out of the 'style' attribute. For example, a value like '1px; background: url(\"javascript:alert(1)\")' or using a double quote to close the style attribute and add an event handler like '\" onmouseover=\"alert(1)' will result in the execution of arbitrary JavaScript when the rendered page is viewed by other users, including administrators.","gemini-3-flash-preview","2026-07-25 10:08:14","2026-07-25 10:08:51",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","2.3.0","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwedocs\u002Ftags\u002F2.3.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwedocs.2.3.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwedocs\u002Ftags\u002F2.3.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwedocs.2.3.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwedocs\u002Ftags"]