Smidi

**Name of the Vulnerable Software and Affected Versions** BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor versions prior to 4.5.4 **Description** Stored Cross-Site Scripting occurs via the `blockId` attribute of the 'betterdocs/category-slate-layout' Gutenberg block. The issue stems from insufficient input sanitization and output escaping in the `CategorySlateLayout::render()` function, which echoes the `blockId` attribute directly into an HTML class attribute without using `esc attr()`. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update to a version newer than 4.5.3. As a temporary workaround, restrict access for users with contributor-level permissions to edit Gutenberg blocks until the update is applied.