WP Docs CVE-2026-81782

Exploitation requires the attacker to hold a subscriber-level (or higher) account on the target WordPress installation, meaning subscriber self-registration must be enabled or the attacker must obtain credentials through another means. Victim interaction is required: a higher-privileged user (typically an administrator or editor) must browse or review the content submitted by the subscriber. The vulnerability is specific to WordPress sites running the WP Docs plugin at version 2.3.1 or earlier. Sites that disable open user registration or restrict WP Docs content submission to trusted roles significantly limit exploitability. No special server-side configuration beyond the default plugin installation is required to be vulnerable.

The CVSS 6.5 score reflects a medium-severity, network-accessible stored XSS requiring subscriber-level authentication and victim interaction. While the raw score is not critical, the scope change (S:C) elevates practical risk because a subscriber can target administrator sessions, potentially enabling privilege escalation, credential harvesting, or administrative action hijacking. Even a mid-sized municipal IT team in sanok running a documentation-heavy WordPress deployment should treat this as a meaningful elevation-of-privilege risk rather than a routine low-severity XSS. EPSS data is not present in the input, and neither CISA KEV status nor any public exploit code is reported, which moderates urgency. The A:L component in the vendor CVSS is atypical for XSS (which usually carries no availability impact) and may be an overstatement; this is flagged in confidence notes. The primary real-world risk is administrator account compromise via session hijacking on sites with open subscriber registration.

An attacker registers or obtains a subscriber-level WordPress account on a target site running WP Docs ≤2.3.1. The attacker submits a documentation entry containing an obfuscated JavaScript payload - for example a cookie-stealer or form-overlay - through the WP Docs interface. When an administrator reviews or browses the documentation, the script executes in their browser session, exfiltrating their session token or performing authenticated administrative actions on the attacker's behalf.