The Smart Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'smartdocs_search' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Metrics
Affected Vendors & Products
References
History
Wed, 09 Jul 2025 18:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Archalj
Archalj smart Docs |
|
CPEs | cpe:2.3:a:archalj:smart_docs:*:*:*:*:*:wordpress:*:* | |
Vendors & Products |
Archalj
Archalj smart Docs |
Tue, 08 Jul 2025 14:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Fri, 04 Jul 2025 02:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The Smart Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'smartdocs_search' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
Title | Smart Docs <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting | |
Weaknesses | CWE-79 | |
References |
| |
Metrics |
cvssV3_1
|

Status: PUBLISHED
Assigner: Wordfence
Published: 2025-07-04T01:44:04.575Z
Updated: 2025-07-08T14:10:41.541Z
Reserved: 2025-06-27T12:51:53.444Z
Link: CVE-2025-6787

Updated: 2025-07-08T14:10:38.424Z

Status : Analyzed
Published: 2025-07-04T03:15:23.403
Modified: 2025-07-09T17:46:49.343
Link: CVE-2025-6787

No data.