CVE-2026-75980

Name of the Vulnerable Software and Affected Versions BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot versions prior to 4.8.2

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. The issue occurs when the process content for toc() function calls html entity decode() on stored content, allowing a malicious payload within a heading id attribute to be extracted by a regex and echoed unescaped into the Table of Contents output. This enables the execution of arbitrary web scripts when a user accesses the affected page.

Recommendations Update BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot to version 4.8.2 or later.