WP Docs

WP Docs has 11 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; 10 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 5.6, and the most serious one scores 6.5 out of 10. 2026 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Scripting, behind 6 of the records (55%). Other recurring categories include Missing Authorization, Cross-Site Request Forgery (CSRF).

10 of the records (91%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

8 independent researchers contributed these findings, most of them (2) reported by István Márton. WP Docs is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.6/ 10
Patch Coverage91%
Open

1

Fixed

10

Get automatic notifications for all WP Docs vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2026-81782

WP Docs <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

11 records
WP Docs banner
Latestv2.3.4
4.8(18)
96/100
Last Updated
2026-09-15 (1mo ago)
Active Installs
1,000+
Downloads
67,241
Requires WP
3.5+
Requires PHP
7.0+
Tested up to
WP 7.1.3
Created
2016-02-09 (11y ago)

Author: Fahad Mahmood Project URI: http://androidbubble.com/blog/wordpress/plugins/wp-docs Demo URI: https://nsvwaterplan.org/documents-library License: GPL 3. See License below for copyright jots and titles. WP Docs is a documents management plugin. You can manage user roles to restrict access to files, directory view, file types allowed for uploading. Nicely managed layouts with optional Bootstrap wrappers. Tags upload, download, library, files, breadcrumb How it works? WP Docs Insights Breadcrumb bar is available for a better navigation. Front end refresh based files browser. Front end ajax based browsing. Document preview and thumbnails available for most file types. Multiple directory views are available, also with the shortcodes. Multiple instances are possible with the shortcodes, icons, list and details. Posts created for each new directory and your library items will be considered as file items using meta fields for post efficiently. The ability to create unlimited, edit and delete directories and sub-directories. A smooth navigation experience based on jQuery/Ajax instead of page refresh. This is a premium feature. Each folder can have a separate shortcode so you can use different pages for different directory listing and files inside. Folder icon and title size can be changed in pixels or percentage from settings page. License This WordPress Plugin is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or any later version. This free software is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this software. If not, see http://www.gnu.org/licenses/gpl-2.0.html.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C