CVE-2026-3878

CVE-2026-3878 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Docs WordPress plugin affecting all versions up to and including 2.2.9. The flaw exists in the 'wpdocs_options[icon_size]' parameter due to insufficient input sanitization and output escaping, allowing authenticated attackers with subscriber-level or higher privileges to inject malicious scripts that execute when users access affected pages. The vulnerability carries a CVSS 3.1 score of 6.4 (Medium severity) with a network-based attack vector requiring low complexity and low privileges, but no user interaction. The impact is limited to confidentiality and integrity compromise with no availability impact. The FAUCET Risk Score of 35.0 out of 100 indicates a moderate threat level within the WordPress ecosystem. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and shows very low exploit probability based on EPSS scoring. Community attention remains minimal as indicated by its inactive status on threat tracking lists, with no readily available public exploit code identified at this time. Organizations should nevertheless prioritize updating WP Docs installations to versions beyond 2.2.9 to mitigate the risk of insider attacks.