weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.1.15 - Unauthenticated Sensitive Information Exposure

Wordfence Intelligence   >   Vulnerability Database   >   weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.1.15 - Unauthenticated Sensitive Information Exposure
5.3
Exposure of Sensitive Information to an Unauthorized Actor
CVE CVE-2025-14574
CVSS 5.3 (Medium)
Publicly Published January 8, 2026
Last Updated January 9, 2026
Researcher DityaRA

Description

The weDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.15 via the `/wp-json/wp/v2/docs/settings` REST API endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including third party services API keys.

References

Share

Vulnerability Details for weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot

weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot

Software Type Plugin
Software Slug wedocs (view on wordpress.org)
Patched? Yes
Remediation Update to version 2.1.16, or a newer patched version
Affected Version
  • <= 2.1.15
Patched Version
  • 2.1.16

Recent vulnerabilities in weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot

weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'connectorWidth' Block Attribute
6.4
CVE-2026-12734
Jul 2, 2026
Researcher: Wordfence PRISM
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Data Migration via wedocs_migrate_betterdocs_to_wedocs AJAX Action
4.3
CVE-2026-12729
Jul 2, 2026
Researcher: Wordfence PRISM
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes
6.4
CVE-2026-12731
Jul 2, 2026
Researcher: Wordfence PRISM
weDocs <= 2.1.18 - Missing Authorization
5.3
CVE-2026-39520
Feb 25, 2026
Researcher: hhhai
weDocs <= 2.1.16 - Missing Authorization to Authenticated (Subscriber+) Documentation Post Update
4.3
CVE-2025-13921
Jan 22, 2026
Researcher: blue0x1
weDocs <= 2.1.14 - Missing Authorization to Settings Update
5.4
CVE-2025-12505
Dec 5, 2025
Researcher: Md. Moniruzzaman Prodhan (NomanProdhan)
weDocs <= 2.1.4 - Missing Authorization
5.3
CVE-2024-34442
May 7, 2024
Researcher: Peng Zhou
Appsero <= 1.2.1 - Missing Authorization
4.3
CVE ID Unknown
Dec 16, 2022
Researchers:
Appsero <= 1.2.0 - Cross-Site Request Forgery
4.3
CVE-2022-47150
Dec 14, 2022
Researcher: István Márton
# Title CVE ID CVSS Researchers Date
1 weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'connectorWidth' Block Attribute CVE-2026-12734 6.4 Wordfence PRISM July 2, 2026
2 weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Data Migration via wedocs_migrate_betterdocs_to_wedocs AJAX Action CVE-2026-12729 4.3 Wordfence PRISM July 2, 2026
3 weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes CVE-2026-12731 6.4 Wordfence PRISM July 2, 2026
4 weDocs <= 2.1.18 - Missing Authorization CVE-2026-39520 5.3 hhhai February 25, 2026
5 weDocs <= 2.1.16 - Missing Authorization to Authenticated (Subscriber+) Documentation Post Update CVE-2025-13921 4.3 blue0x1 January 22, 2026
6 weDocs <= 2.1.14 - Missing Authorization to Settings Update CVE-2025-12505 5.4 Md. Moniruzzaman Prodhan (NomanProdhan) December 5, 2025
7 weDocs <= 2.1.4 - Missing Authorization CVE-2024-34442 5.3 Peng Zhou May 7, 2024
8 Appsero <= 1.2.1 - Missing Authorization 4.3 December 16, 2022
9 Appsero <= 1.2.0 - Cross-Site Request Forgery CVE-2022-47150 4.3 István Márton December 14, 2022
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation