CVE-2026-3878: WP Docs Plugin XSS Vulnerability

CVE-2026-3878 Overview

The WP Docs plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 2.2.9. The flaw resides in the wpdocs_options[icon_size] parameter, which lacks adequate input sanitization and output escaping [CWE-79]. Authenticated attackers holding subscriber-level access or higher can inject arbitrary JavaScript that executes when users view affected pages. The injected payload persists in plugin configuration, making this a stored variant rather than reflected XSS. Successful exploitation enables session theft, administrative action forgery, and redirection to attacker-controlled infrastructure.

Critical Impact
Authenticated subscribers can store JavaScript payloads that execute in administrator browsers, enabling account takeover and persistent site compromise.

Affected Products

WP Docs plugin for WordPress, versions through 2.2.9
WordPress sites permitting subscriber-level or higher registration
Any site using the wpdocs_options configuration with the vulnerable icon_size parameter

Discovery Timeline

2026-04-16 - CVE-2026-3878 published to NVD
2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-3878

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw in the WP Docs plugin. The plugin accepts user-supplied content for the wpdocs_options[icon_size] parameter without applying sufficient sanitization on input or escaping on output. WordPress provides functions such as sanitize_text_field() and esc_attr() for these tasks, but the plugin fails to apply them to this parameter.

An authenticated user with subscriber privileges or higher can submit crafted input containing HTML or JavaScript. The payload is persisted in the WordPress options table and rendered back into pages when other users, including administrators, visit affected views. The injected script executes in the victim's browser session against the WordPress origin.

Because the attack only requires subscriber-level access, sites that permit open user registration face increased exposure. The scope change in the impact metrics reflects that an attacker can affect resources beyond their own privilege level.

Root Cause

The root cause is missing input validation and missing output encoding for the icon_size configuration value. The plugin treats the parameter as trusted plugin configuration data without recognizing that lower-privileged authenticated users can reach the saving routine.

Attack Vector

An attacker authenticates as a subscriber, then submits a crafted value for wpdocs_options[icon_size] containing JavaScript. When any user loads a page that renders the option, the script executes in their browser. Administrative visitors are the highest-value targets because their session cookies grant full site control.

No verified proof-of-concept exploitation code has been published. Refer to the WordPress Trac Changeset for the corrective patch and to the Wordfence Vulnerability Report for analyst commentary.

Detection Methods for CVE-2026-3878

Indicators of Compromise

Unexpected <script> tags, event handlers such as onerror= or onload=, or javascript: URIs in the wpdocs_options row of the wp_options database table
Outbound browser requests from administrator sessions to unknown external domains following navigation to WP Docs pages
Newly created administrator accounts or modified user roles shortly after subscriber accounts interacted with plugin settings

Detection Strategies

Query the WordPress database for the wpdocs_options record and inspect the icon_size field for non-numeric or HTML content
Review web server logs for POST requests targeting WP Docs admin-ajax or options endpoints originating from low-privilege accounts
Run a server-side scan across plugin output pages for reflected configuration values containing script syntax

Monitoring Recommendations

Alert on modifications to wp_options rows associated with installed plugins by non-administrator users
Monitor for new subscriber account registrations followed by rapid access to WP Docs configuration endpoints
Track Content Security Policy (CSP) violation reports for inline script execution on pages rendering plugin output

How to Mitigate CVE-2026-3878

Immediate Actions Required

Update the WP Docs plugin to a version above 2.2.9 that incorporates the fix from changeset 3481830
Audit the wpdocs_options database entry for any malicious payload and clear suspect values
Review administrator session activity and force password resets if unexplained activity is observed

Patch Information

The vendor addressed the issue in the WordPress.org plugin repository via changeset 3481830. The patch adds sanitization and escaping for the icon_size option. Site administrators should apply the update through the WordPress admin dashboard or via WP-CLI.

Workarounds

Temporarily deactivate the WP Docs plugin until the patched version is installed
Restrict user registration and review existing subscriber-level accounts for legitimacy
Deploy a Content Security Policy that blocks inline scripts to limit the impact of stored XSS payloads

bash

# Update WP Docs plugin using WP-CLI
wp plugin update wp-docs

# Verify installed version
wp plugin get wp-docs --field=version

# Inspect the stored option for suspicious content
wp option get wpdocs_options --format=json