CVE-2026-93923

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with fu...

CVE-2026-93923: Improper Neutralization of Input During Web Page Generation

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with fu...

CVE-2026-93923 SiYuan through 3.8.4 Stored XSS via Heading Style Attribute

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with fu...

CVE-2026-93923 SiYuan through 3.8.4 Stored XSS via Heading Style Attribute

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with fu...

CVE-2026-93923

SiYuan through version 3.8.4 is affected by a stored cross-site scripting (XSS) vulnerability caused by a failure to escape heading style attributes when rendering the outline and bookmark dock HTML. Attackers can inject malicious style values by supplying crafted notebooks or calling administrat...

CVE-2026-93923 SiYuan through 3.8.4 Stored XSS via Heading Style Attribute

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with fu...

PT-2026-95721

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.5 Description Stored cross-site scripting occurs because the software fails to escape heading style attributes when rendering HTML for the outline and bookmark dock. Attackers can inject malicious style values by...

EUVD-2026-72392

league/commonmark versions = 2.0.0 and 2.8.4 patched in 2.9.0 contain a denial of service vulnerability in UniqueSlugNormalizer::normalize, which restarts its numeric-suffix search from 1 on every slug collision, resulting in OK^2 time complexity for K headings that collapse to the same base slug...

SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

CVE: This vulnerability corresponds to CVE-2026-68584. Summary SiYuan's publish mode defines a "protected" access level: a document that is publicly listed but requires a password to read per the product's own UI help text, protected = "Publicly visible, requires password to access". The password...

SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check

CVE: This vulnerability corresponds to CVE-2026-68587. Summary Three "heading transaction" endpoints /api/block/getHeadingDeleteTransaction, /api/block/getHeadingLevelTransaction, and /api/block/getHeadingInsertTransaction return the rendered block DOM of a heading and its subtree in the computed...

GHSA-69MH-GVH4-8GP7 SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check

CVE: This vulnerability corresponds to CVE-2026-68587. Summary Three "heading transaction" endpoints /api/block/getHeadingDeleteTransaction, /api/block/getHeadingLevelTransaction, and /api/block/getHeadingInsertTransaction return the rendered block DOM of a heading and its subtree in the computed...

EUVD-2026-52275

SiYuan: Full-content disclosure of publish-disabled documents via getHeadingTransaction endpoints publish mode: reader-reachable rendered DOM with no publish-access check...

CVE-2026-75980

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-75980

CVE-2026-75980 is a Stored Cross-Site Scripting (XSS) vulnerability in the BetterDocs WordPress plugin (versions ≤ 4.8.1), discovered by Wordfence PRISM . The flaw resides in the Heading 'id' attribute within post content: entity-encoded quotes bypass wp_kses_post at save time, and the payload ma...

CVE-2026-75980 BetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-75980 BetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

EUVD-2026-68986

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

PT-2026-84117

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-75980: Improper Neutralization of Input During Web Page Generation

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

WordPress BetterDocs plugin <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin BetterDocs versions = 4.8.1...