WP Docs
WP Docs has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 10 are fixed as of September 2026. Their average CVSS score is 5.5, and the most serious one scores 6.5 out of 10. 2024 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Scripting, behind 5 of the records (50%). Other recurring categories include Missing Authorization, Cross-Site Request Forgery (CSRF).
Every one of the 10 issues recorded for WP Docs has a vendor fix available, so running the current release closes all known holes.
7 independent researchers contributed these findings, most of them (2) reported by István Márton. WP Docs is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2024-12635WP Docs <= 2.2.0 - Authenticated (Subscriber+) Time-Based SQL Injection via 'dir_id'
Read the full analysisVulnerability Records

WP Docs
Author
Fahad Mahmood
Author: Fahad Mahmood Project URI: http://androidbubble.com/blog/wordpress/plugins/wp-docs Demo URI: https://nsvwaterplan.org/documents-library License: GPL 3. See License below for copyright jots and titles. WP Docs is a documents management plugin. You can manage user roles to restrict access to files, directory view, file types allowed for uploading. Nicely managed layouts with optional Bootstrap wrappers. Tags upload, download, library, files, breadcrumb How it works? WP Docs Insights Breadcrumb bar is available for a better navigation. Front end refresh based files browser. Front end ajax based browsing. Document preview and thumbnails available for most file types. Multiple directory views are available, also with the shortcodes. Multiple instances are possible with the shortcodes, icons, list and details. Posts created for each new directory and your library items will be considered as file items using meta fields for post efficiently. The ability to create unlimited, edit and delete directories and sub-directories. A smooth navigation experience based on jQuery/Ajax instead of page refresh. This is a premium feature. Each folder can have a separate shortcode so you can use different pages for different directory listing and files inside. Folder icon and title size can be changed in pixels or percentage from settings page. License This WordPress Plugin is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or any later version. This free software is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this software. If not, see http://www.gnu.org/licenses/gpl-2.0.html.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C