What is the CVSS score of CVE-2026-3878?

CVE-2026-3878 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Wp Docs CVE-2026-3878

EUVD-2026-23168 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-16 Wordfence

WordPress XSS Wp Docs Wordpress Plugin Fahadmahmood

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 16, 2026 - 04:15 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 04:00 euvd

EUVD-2026-23168

Analysis Generated

Apr 16, 2026 - 04:00 vuln.today

CVE Published

Apr 16, 2026 - 03:36 nvd

MEDIUM 6.4

DescriptionCVE.org

The WP Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdocs_options[icon_size]' parameter in all versions up to, and including, 2.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting (XSS) in WP Docs plugin for WordPress (all versions through 2.2.9) allows authenticated attackers with subscriber-level access to inject malicious scripts via the 'wpdocs_options[icon_size]' parameter due to insufficient input sanitization and output escaping. The injected scripts execute in the context of any user accessing the affected page, enabling session hijacking, credential theft, or malware distribution with no user interaction required beyond normal site browsing. No public exploit code has been identified, but the vulnerability is technically straightforward to exploit given valid subscriber credentials.

Technical ContextAI

The vulnerability stems from improper handling of the 'wpdocs_options[icon_size]' parameter in the WP Docs plugin, a WordPress plugin designed to manage documentation. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), resulting from both insufficient input sanitization during parameter processing and inadequate output escaping when rendering the parameter value in HTML context. WordPress plugins process user-supplied settings through the options API; when plugin developers fail to use functions like sanitize_text_field() during input and esc_attr() or esc_html() during output, attacker-supplied JavaScript can persist in the WordPress database and execute in any user's browser. The CPE string cpe:2.3:a:fahadmahmood:wp_docs:*:*:*:*:*:*:*:* indicates the vulnerability affects all versions of the plugin authored by Fahad Mahmood.

RemediationAI

Update the WP Docs plugin to version 2.2.10 or later. The fix is available in WordPress plugin repository changeset 3481830 (https://plugins.wordpress.org/changeset/3481830/wp-docs), which addresses the vulnerability by implementing proper input sanitization using WordPress sanitization functions and output escaping using appropriate escaping functions such as esc_attr() for HTML attributes. Organizations unable to upgrade immediately should restrict the 'manage_options' capability (which controls access to plugin settings) to trusted administrator accounts only, and implement Content Security Policy (CSP) headers with script-src restrictions to limit the execution scope of injected scripts, though this is a temporary control and not a substitute for patching. Additionally, review WordPress user roles and remove subscriber-level access from users who do not require it, reducing the attack surface to those with legitimate need to modify plugin settings.