CVE-2026-104760

Name of the Vulnerable Software and Affected Versions weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot versions prior to 2.6.2

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages via the modalPlaceholder block attribute. These scripts execute in the browser of any administrator or editor who previews or views a pending post containing the malicious payload.

Recommendations Update weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot to version 2.6.2 or later. As a temporary mitigation, restrict the use of the modalPlaceholder block attribute for users with contributor-level access.