Executive brief
The WP Docs plugin for WordPress contains a cross-site scripting (XSS) vulnerability that allows authenticated subscribers to inject malicious scripts into the site. An attacker with subscriber-level access could craft a malicious link or form that, when clicked by a higher-privileged user, executes arbitrary JavaScript code that steals visitor data or hijacks accounts.
Technical details
The WP Docs plugin versions 2.3.1 and earlier are vulnerable to stored or reflected XSS due to insufficient input sanitization or output encoding. The vulnerability requires subscriber-level privileges to trigger, but successful exploitation depends on user interaction (e.g., a victim visiting a crafted page or clicking a malicious link). An attacker can inject malicious scripts that execute in the context of the site, potentially compromising visitor data or hijacking accounts. No official patch is currently available; Patchstack has issued a mitigation rule.
Affected products
- WordPress WP Docs 2.3.1 and earlier
Timeline
- 2026-09-09: disclosed
- 2026-09-10: advisory