CVE-2026-3875

OVERVIEW CVE-2026-3875 is a Stored Cross-Site Scripting vulnerability affecting the BetterDocs plugin for WordPress in all versions up to and including 4.3.8. The flaw exists in the 'betterdocs_feedback_form' shortcode due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Attackers with contributor-level access or higher can inject arbitrary web scripts that execute whenever users access affected pages. SEVERITY The vulnerability carries a CVSS score of 6.4 (Medium) with a network-based attack vector requiring low complexity and no user interaction. The attack requires low privileges (contributor access) but affects the confidentiality and integrity of the system across scope boundaries. The potential impact includes unauthorized script execution and data exposure, though availability is not affected. EXPLOITATION STATUS There is no evidence of active exploitation. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and does not appear on the Hot List, indicating minimal community attention or public exploit availability. The extremely low EPSS score of 0.0001 suggests this vulnerability currently poses minimal real-world risk relative to the broader threat landscape.