WordPress security by component

WP Docs

Plugin description

WP Docs is a WordPress component with 9 published CVE records in this archive. The latest tracked vulnerability was published Apr 16, 2026; the highest CVE/CNA score is 7.1.

Plugin slug: wp-docs

Latest vulnerability

CVE-2026-3878: WP Docs: Cross-site scripting

WP Docs is affected by cross-site scripting. Exploitation requires at least subscriber-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 2.2.9.

PublishedApr 16, 2026

Known safe version> 2.2.9

		Safe version
Apr 16, 2026	CVE-2026-3878 WP Docs: Cross-site scripting WP Docs is affected by cross-site scripting. Exploitation requires at least subscriber-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 2.2.9.	> 2.2.9	CVE6.4 NVDPending
Feb 03, 2026	CVE-2026-24990 WP Docs: A security weakness WP Docs is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.4 NVDPending
Mar 31, 2025	CVE-2025-31417 WP Docs: A security weakness WP Docs is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3 NVDPending
Jan 07, 2025	CVE-2024-56288 WP Docs: Cross-site scripting WP Docs is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9 NVD4.8
Dec 21, 2024	CVE-2024-12635 WP Docs: SQL injection WP Docs is affected by SQL injection. Exploitation requires at least subscriber-level access. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE6.5 NVD6.5
Dec 09, 2024	CVE-2023-30873 WP Docs: A security weakness WP Docs is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.4 NVD8.8
Jun 08, 2024	CVE-2024-35696 WP Docs: Cross-site scripting WP Docs is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.1 NVD6.1
Jun 08, 2024	CVE-2024-35695 WP Docs: Cross-site scripting WP Docs is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5 NVD5.4
Aug 18, 2023	CVE-2023-32106 Wp Docs: Cross-site scripting Wp Docs is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.1 NVD6.1