CVE-2026-12731

Name of the Vulnerable Software and Affected Versions weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot versions prior to 2.3.1

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts through the sectionTitleTag and articleTitleTag block attributes, which execute when a user views the affected page.

Recommendations Update to a version newer than 2.3.0. Restrict the use of the sectionTitleTag and articleTitleTag attributes until the update is applied.