Medium severity · published Jan 9, 2026
CVE-2025-14980
BetterDocs <= 4.3.3 - Authenticated (Contributor+) Sensitive Information Exposure
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
The BetterDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.3 via the scripts() function. This makes it possible for authenticated attackers, with contributor-level access and above, to extract sensitive data including the OpenAI API key stored in plugin settings.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BK
BetterDocs – Knowledge Base Docs & FAQ Solution for Elementor & Block Editor · wpdevteam
through 4.3.3 · source: vendor
Affected product
BK
BetterDocs – Knowledge Base Docs & FAQ Solution for Elementor & Block Editor
wpdevteam
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14980
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14980
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3430424%40betterdocs%2Ftags%2F4.3.4&old=3422660%40betterdocs%2Ftrunk
research.cleantalk.org
https://research.cleantalk.org/cve-2025-14980/
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/1595f231-d300-484a-a0e1-1e2bc7b82ed3?source=cve
More from BetterDocs – Knowledge Base Docs & FAQ Solution for Elementor & Block Editor
6.4
CVE-2026-3875
BetterDocs <= 4.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
4.3
CVE-2026-6393
BetterDocs <= 4.3.11 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usage