CVE-2026-12157

Name of the Vulnerable Software and Affected Versions BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor versions prior to 4.5.4

Description Stored Cross-Site Scripting occurs via the blockId attribute of the 'betterdocs/category-slate-layout' Gutenberg block. The issue stems from insufficient input sanitization and output escaping in the CategorySlateLayout::render() function, which echoes the blockId attribute directly into an HTML class attribute without using esc attr(). This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update to a version newer than 4.5.3. As a temporary workaround, restrict access for users with contributor-level permissions to edit Gutenberg blocks until the update is applied.