The WP Docs plugin stores a value called 'wpdocs_options[icon_size]' without proper sanitization or escaping. A subscriber or higher role can set this value in the plugin’s settings. The value is then persisted in the database and later rendered into web pages without filtering, allowing an attacker to embed arbitrary JavaScript. When a victim user visits a page that includes this value, the injected script runs in the victim’s browser, enabling cookie theft, session hijacking, defacement or execution of malicious actions on behalf of the user.

Any WordPress installation running the WP Docs plugin version 2.2.9 or earlier is affected. The plugin is distributed by the vendor fahadmahmood (WP Docs).

The CVSS score of 6.4 indicates a moderate severity vulnerability that can be exploited by any authenticated user with subscriber-level access, the lowest role that can configure the plugin. The materialization of the flaw does not require any network‑level exploits; it relies on legitimate credentials and platform access. EPSS is not available and the issue is not listed in the CISA KEV catalog, suggesting the attack probability is currently unclear, but the output results in cross‑site scripting and can lead to significant compromise of user sessions.