Wp Docs EUVD-2026-23168

Successful exploitation requires: (1) an authenticated WordPress user account with at least subscriber-level role, which grants access to plugin settings pages; (2) the WP Docs plugin installed and activated on the WordPress installation; (3) the vulnerable 'wpdocs_options[icon_size]' parameter exposed through the plugin's settings interface (accessible via /wp-admin/admin.php?page=wpdocs or similar). The vulnerability does NOT require users to click malicious links, disable security features, or interact with the site in any special way beyond routine access to pages where the setting is rendered. The vulnerability is limited to the 'icon_size' parameter specifically, though similar issues may exist in other plugin parameters if they use the same insecure coding pattern. Organizations with strict subscriber account policies or those that disable user registration are at lower practical risk, as exploitation requires valid credentials.

While the CVSS 6.4 score is moderate, the real-world risk is elevated by several factors. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) indicates network attack surface with low complexity and no user interaction required, meaning any authenticated subscriber can trigger the vulnerability without deceiving other users. The scope change flag (S:C) confirms impact extends to confidentiality and integrity of other users' sessions and data. However, exploitation is limited by the authentication requirement (PR:L - subscriber-level access needed), which is a meaningful barrier in public-facing sites but negligible in internal or community-driven WordPress instances where users freely register. The CVSS impact ratings (C:L/I:L for confidentiality and integrity with no availability impact) suggest the vulnerability is suitable for targeted attacks (credential harvesting, account takeover via session hijacking) rather than mass site defacement. The straightforward nature of the payload injection (a parameter stored and reflected) and the prevalence of WordPress make this a priority for patching, but it does not justify emergency response protocols for organizations with strict WordPress subscriber policies.

An attacker with or having obtained subscriber-level WordPress credentials navigates to the WP Docs plugin settings page and injects a malicious JavaScript payload (e.g., 'javascript:fetch("/wp-json/wp/v2/users/1",...)') into the 'icon_size' parameter. The payload is stored in the WordPress options table without sanitization. When any site administrator or user visits the plugin settings page or a page where the icon size setting is rendered, the injected script executes in their browser context, allowing the attacker to steal session cookies, capture login credentials, or perform administrative actions on their behalf.