CVE-2026-3878: WP Docs Plugin Stored XSS Vulnerability

CVE-2026-3878 Overview

The WP Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the wpdocs_options[icon_size] parameter in all versions up to and including 2.2.9. This vulnerability exists due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts into pages that execute whenever a user accesses the affected page.

Critical Impact

Authenticated attackers can persistently inject malicious JavaScript that executes in the browsers of all users viewing affected pages, potentially leading to session hijacking, credential theft, or further site compromise.

Affected Products

• WP Docs plugin for WordPress versions up to and including 2.2.9

Discovery Timeline

• 2026-04-16 - CVE CVE-2026-3878 published to NVD
• 2026-04-16 - Last updated in NVD database

Technical Details for CVE-2026-3878

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability affects the WP Docs plugin's handling of the wpdocs_options[icon_size] parameter. When administrators or users interact with the plugin settings, the icon_size parameter value is stored in the database without proper sanitization. Subsequently, when this value is rendered on pages, it is output without adequate escaping, allowing injected scripts to execute in the context of the victim's browser session.

The attack requires network access and low privileges (subscriber-level), making it accessible to any authenticated user on a vulnerable WordPress installation. The scope is changed, meaning the vulnerability can impact resources beyond the vulnerable component itself, potentially affecting the entire WordPress site and its visitors.

Root Cause

The root cause of this vulnerability is insufficient input sanitization when processing the wpdocs_options[icon_size] parameter and inadequate output escaping when the stored value is rendered on the page. WordPress provides built-in sanitization functions such as sanitize_text_field() and escaping functions like esc_attr() and esc_html() that should be applied to user-controllable input, but these were not properly implemented for the vulnerable parameter.

Attack Vector

The attack is carried out over the network by an authenticated user with at least subscriber-level access. The attacker crafts a malicious payload containing JavaScript code and submits it through the wpdocs_options[icon_size] parameter. This payload is stored persistently in the WordPress database. When any user (including administrators) subsequently views a page where the icon_size setting is rendered, the malicious script executes in their browser context.

The exploitation mechanism involves injecting JavaScript code through the vulnerable parameter. An attacker could craft a payload that breaks out of the expected HTML context and injects a script tag or event handler. Once stored, this payload persists and executes for every user who views the affected page, making it a persistent XSS attack vector. For detailed technical information, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-3878

Indicators of Compromise

• Unexpected JavaScript code or encoded payloads stored in the wpdocs_options database entries
• Suspicious icon_size parameter values containing HTML tags, script tags, or event handlers
• User reports of browser warnings, redirects, or unexpected behavior when viewing WP Docs-related pages
• Anomalous subscriber-level user activity involving plugin settings modification

Detection Strategies

• Review WordPress database for malicious content in the wp_options table related to wpdocs_options
• Monitor HTTP requests for unusual payloads targeting the wpdocs_options[icon_size] parameter
• Implement Web Application Firewall (WAF) rules to detect XSS patterns in plugin parameter submissions
• Enable WordPress audit logging to track changes to plugin settings by non-administrative users

Monitoring Recommendations

• Configure SentinelOne Singularity to monitor for script injection attempts and suspicious JavaScript execution patterns
• Set up alerts for subscriber-level users attempting to modify plugin configuration options
• Implement Content Security Policy (CSP) headers to mitigate the impact of successful XSS attacks
• Regularly scan the WordPress database for stored XSS indicators using security plugins

How to Mitigate CVE-2026-3878

Immediate Actions Required

• Update the WP Docs plugin to a version newer than 2.2.9 that contains the security fix
• Review and audit all existing wpdocs_options entries in the database for malicious content
• Temporarily restrict subscriber-level access to plugin settings if an update is not immediately available
• Consider temporarily disabling the WP Docs plugin until it can be updated

Patch Information

The vulnerability has been addressed in the WP Docs plugin. The security patch can be reviewed at the WordPress Changeset Update. Update the plugin through the WordPress admin dashboard or manually download and install the patched version from the WordPress plugin repository.

Workarounds

• Implement a Web Application Firewall (WAF) with rules to filter XSS payloads targeting WordPress plugin parameters
• Restrict user registration and limit the number of users with subscriber-level access or above
• Add server-side input validation for the icon_size parameter to accept only numeric values
• Deploy Content Security Policy (CSP) headers to limit script execution to trusted sources

# Configuration example - Add CSP header in .htaccess or server configuration
# Apache .htaccess example:
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"

# Nginx configuration example:
# add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';";