Stored XSS in BetterDocs WordPress Plugin via CategorySlateLayout

Detection Guidance

This vulnerability involves the BetterDocs WordPress plugin versions up to 4.5.3, where the blockId attribute in the betterdocs/category-slate-layout Gutenberg block is vulnerable to stored cross-site scripting due to insufficient sanitization.

To detect this vulnerability on your system, you should check the installed version of the BetterDocs plugin to see if it is version 4.5.3 or earlier.

You can use the following command on your WordPress installation to check the plugin version:

• grep -i 'betterdocs' wp-content/plugins/betterdocs/readme.txt

Alternatively, you can check the plugin version via the WordPress admin dashboard under Plugins.

To detect if any pages have been injected with malicious scripts via this vulnerability, you can search your WordPress database for suspicious script tags or unusual content in posts or pages that use the betterdocs/category-slate-layout block.

• Use a database query like: SELECT post_content FROM wp_posts WHERE post_content LIKE '%<script%' AND post_content LIKE '%betterdocs/category-slate-layout%';

Useful 0 Not Useful 0

Executive Summary

The BetterDocs - Knowledge Base Docs & FAQ Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the blockId attribute of the betterdocs/category-slate-layout Gutenberg block in versions up to and including 4.5.3.

This vulnerability exists because the plugin does not properly sanitize or escape input in the CategorySlateLayout::render() method, which directly outputs the blockId attribute into an HTML class attribute without using esc_attr().

As a result, authenticated users with contributor-level access or higher can inject arbitrary web scripts into pages, which will execute whenever any user accesses the injected page.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with contributor-level access or above to inject malicious scripts into pages.

These scripts can execute in the browsers of users who visit the affected pages, potentially leading to theft of user data, session hijacking, or other malicious activities.

Because the vulnerability is a Stored Cross-Site Scripting issue, the injected scripts persist on the site and affect all users who view the compromised content.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the BetterDocs plugin to a version later than 4.5.3 where this vulnerability is fixed.

If updating immediately is not possible, restrict contributor-level and higher user permissions temporarily to trusted users only, as the vulnerability requires authenticated contributor-level access or above.

Additionally, review and sanitize any content created by contributors that uses the betterdocs/category-slate-layout block to remove any injected scripts.

Consider implementing a Web Application Firewall (WAF) rule to block suspicious script injections targeting this plugin.

Useful 0 Not Useful 0