{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3878", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-10T12:47:39.946Z", "datePublished": "2026-04-16T03:36:36.430Z", "dateUpdated": "2026-04-16T03:36:36.430Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-16T03:36:36.430Z"}, "affected": [{"vendor": "fahadmahmood", "product": "WP Docs", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.2.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdocs_options[icon_size]' parameter in all versions up to, and including, 2.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "WP Docs <= 2.2.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpdocs_options[icon_size]'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e11ecf13-0b3b-4148-abca-677652a68c24?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3481830/wp-docs"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2026-04-15T14:25:18.000Z", "lang": "en", "value": "Disclosed"}]}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdocs_options[icon_size]' parameter in all versions up to, and including, 2.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2026-3878", "lastModified": "2026-04-16T04:17:09.813", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-16T04:17:09.813", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3481830/wp-docs"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e11ecf13-0b3b-4148-abca-677652a68c24?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.2.9]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WP Docs", "source": "cna", "vendor": "fahadmahmood"}, "product": "wp_docs", "vendor": "fahadmahmood"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T08:59:26.864505+00:00", "value": {"mitigation_remediation": ["Update WP Docs to the latest version (2.3 or later) to enable proper input sanitization of the 'icon_size' field.", "If updating is not immediately possible, restrict the value of 'icon_size' by editing the plugin\u2019s code or the database so that only whitelisted numeric values are accepted, or reset the setting to the default value and prevent further changes via role permissions.", "Configure role permissions so that only trusted administrators or editors can modify the WP Docs settings, limiting the ability of subscriber or lower\u2011level users to inject malicious scripts."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Any WordPress installation running the WP Docs plugin version 2.2.9 or earlier is affected. The plugin is distributed by the vendor fahadmahmood (WP Docs).", "description_and_impact": "The WP Docs plugin stores a value called 'wpdocs_options[icon_size]' without proper sanitization or escaping. A subscriber or higher role can set this value in the plugin\u2019s settings. The value is then persisted in the database and later rendered into web pages without filtering, allowing an attacker to embed arbitrary JavaScript. When a victim user visits a page that includes this value, the injected script runs in the victim\u2019s browser, enabling cookie theft, session hijacking, defacement or execution of malicious actions on behalf of the user.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity vulnerability that can be exploited by any authenticated user with subscriber-level access, the lowest role that can configure the plugin. The materialization of the flaw does not require any network\u2011level exploits; it relies on legitimate credentials and platform access. EPSS is not available and the issue is not listed in the CISA KEV catalog, suggesting the attack probability is currently unclear, but the output results in cross\u2011site scripting and can lead to significant compromise of user sessions."}}}}, "created": "2026-04-16T05:30:25.679219+00:00", "updated": "2026-04-16T09:00:05.298804+00:00", "vendors": ["fahadmahmood", "fahadmahmood$PRODUCT$wp_docs", "wordpress", "wordpress$PRODUCT$wordpress"]}