A vulnerability in the WP Docs WordPress plugin allows authenticated users with subscriber privileges to insert malicious JavaScript that is rendered when plugin content is displayed the visiting user’s browser, an attacker can steal session cookies, deface pages, or redirect users to phishing sites. The flaw maps to the input validation weakness describedWordPress sites that use the WP Docs plugin version 2.3.1 or earlier. The plugin is distributed by Fahad Mahmood:WP Docs. Any site that has not upgraded beyond this version is at risk.

The WP Docs plugin, distributed by Fahad Mahmood, is vulnerable in all versions up to and including 2.3.1. WordPress sites that host the plugin and have not upgraded beyond the 2.3.1 release are affected.

The CVSS score of 6.5 reflects a moderate risk level. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation at this time. The likely attack vector requires an attacker to craft or edit content that will be rendered by the plugin, or to supply malicious output through an editor interface. Once the malicious script is executed in a user’s browser, confidentiality and integrity can be compromised. The threat remains until the plugin is updated or mitigated by defensive controls.