WP Docs
WP Docs has 11 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; 10 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 5.6, and the most serious one scores 6.5 out of 10. 2026 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Scripting, behind 6 of the records (55%). Other recurring categories include Missing Authorization, Cross-Site Request Forgery (CSRF).
10 of the records (91%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.
8 independent researchers contributed these findings, most of them (2) reported by István Márton. WP Docs is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-81782WP Docs <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

WP Docs
Author
Fahad Mahmood
Author: Fahad Mahmood Project URI: http://androidbubble.com/blog/wordpress/plugins/wp-docs Demo URI: https://nsvwaterplan.org/documents-library License: GPL 3. See License below for copyright jots and titles. WP Docs is a documents management plugin. You can manage user roles to restrict access to files, directory view, file types allowed for uploading. Nicely managed layouts with optional Bootstrap wrappers. Tags upload, download, library, files, breadcrumb How it works? WP Docs Insights Breadcrumb bar is available for a better navigation. Front end refresh based files browser. Front end ajax based browsing. Document preview and thumbnails available for most file types. Multiple directory views are available, also with the shortcodes. Multiple instances are possible with the shortcodes, icons, list and details. Posts created for each new directory and your library items will be considered as file items using meta fields for post efficiently. The ability to create unlimited, edit and delete directories and sub-directories. A smooth navigation experience based on jQuery/Ajax instead of page refresh. This is a premium feature. Each folder can have a separate shortcode so you can use different pages for different directory listing and files inside. Folder icon and title size can be changed in pixels or percentage from settings page. License This WordPress Plugin is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or any later version. This free software is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this software. If not, see http://www.gnu.org/licenses/gpl-2.0.html.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C