Plugin security history

WP Docs Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 10 vulnerability records associated with WP Docs, published between 2023 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

10Total records

0Critical

0High

10Medium

0Low

0Informational

10Patched records

0Currently marked unpatched

2023-04-18First disclosure

2026-04-15Latest disclosure

10 of 10CVE coverage

Use this history

Check and watch WP Docs.

A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.

Check my installed version Watch WP Docs

Year-by-Year Timeline

Year	Records	Relative volume
2023	3	3 records
2024	3	3 records
2025	2	2 records
2026	2	2 records

Severity Breakdown

Severity	Records	Share
Medium	10	100%

Vulnerability-Type Breakdown

Cross-Site Scripting

5 records50%

First: 2023. Latest: 2026.

Missing Authorization

3 records30%

First: 2023. Latest: 2026.

CSRF

1 record10%

First: 2023. Latest: 2023.

SQL Injection

1 record10%

First: 2024. Latest: 2024.

Patch Status

Patched: 10
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

2.3.0
2.2.9
2.2.7
2.2.2
2.2.1
2.1.4
2.0.0
1.9.9

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-2.2.9`	WP Docs <= 2.2.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpdocs_options[icon_size]'	April 15, 2026	2.3.0	Medium
`*-2.2.8`	WP Docs <= 2.2.8 - Missing Authorization	January 21, 2026	2.2.9	Medium
`*-2.2.6`	WP Docs <= 2.2.6 - Missing Authorization	March 29, 2025	2.2.7	Medium
`*-2.2.1`	WP Docs <= 2.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting	January 3, 2025	2.2.2	Medium
`*-2.2.0`	WP Docs <= 2.2.0 - Authenticated (Subscriber+) Time-Based SQL Injection via 'dir_id'	December 20, 2024	2.2.1	Medium
`*-2.1.3`	WP Docs <= 2.1.3 - Reflected Cross-Site Scripting	June 6, 2024	2.1.4	Medium
`*-2.1.3`	WP Docs <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	June 6, 2024	2.1.4	Medium
`[*, 2.0.0)`	WP Docs <= 1.9.9 - Reflected Cross-Site Scripting	May 2, 2023	2.0.0	Medium
`*-1.9.8`	WP Docs <= 1.9.8 - Missing Authorization via multiple AJAX actions	April 19, 2023	1.9.9	Medium
`*-1.9.8`	WP Docs <= 1.9.8 - Cross-Site Request Forgery to folder management	April 18, 2023	1.9.9	Medium

Selected source records

Latest Records

MediumCVE-2026-3878

WP Docs <= 2.2.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpdocs_options[icon_size]'

Published: April 15, 2026

Affected versions: *-2.2.9
Patched versions: 2.3.0

Original Wordfence record

MediumCVE-2026-24990

WP Docs <= 2.2.8 - Missing Authorization

Published: January 21, 2026

Affected versions: *-2.2.8
Patched versions: 2.2.9

Original Wordfence record

MediumCVE-2025-31417

WP Docs <= 2.2.6 - Missing Authorization

Published: March 29, 2025

Affected versions: *-2.2.6
Patched versions: 2.2.7

Original Wordfence record

MediumCVE-2024-56288

WP Docs <= 2.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: January 3, 2025

Affected versions: *-2.2.1
Patched versions: 2.2.2

Original Wordfence record

MediumCVE-2024-12635

WP Docs <= 2.2.0 - Authenticated (Subscriber+) Time-Based SQL Injection via 'dir_id'

Published: December 20, 2024

Affected versions: *-2.2.0
Patched versions: 2.2.1

Original Wordfence record

MediumCVE-2024-35695

WP Docs <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: June 6, 2024

Affected versions: *-2.1.3
Patched versions: 2.1.4

Original Wordfence record

MediumCVE-2024-35696

WP Docs <= 2.1.3 - Reflected Cross-Site Scripting

Published: June 6, 2024

Affected versions: *-2.1.3
Patched versions: 2.1.4

Original Wordfence record

MediumCVE-2023-32106

WP Docs <= 1.9.9 - Reflected Cross-Site Scripting

Published: May 2, 2023

Affected versions: [*, 2.0.0)
Patched versions: 2.0.0

Original Wordfence record

Highest-Severity Records

MediumCVE-2024-12635

WP Docs <= 2.2.0 - Authenticated (Subscriber+) Time-Based SQL Injection via 'dir_id'

Published: December 20, 2024

Affected versions: *-2.2.0
Patched versions: 2.2.1

Original Wordfence record

MediumCVE-2024-35695

WP Docs <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: June 6, 2024

Affected versions: *-2.1.3
Patched versions: 2.1.4

Original Wordfence record

MediumCVE-2026-3878

WP Docs <= 2.2.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpdocs_options[icon_size]'

Published: April 15, 2026

Affected versions: *-2.2.9
Patched versions: 2.3.0

Original Wordfence record

MediumCVE-2023-30873

WP Docs <= 1.9.8 - Missing Authorization via multiple AJAX actions

Published: April 19, 2023

Affected versions: *-1.9.8
Patched versions: 1.9.9

Original Wordfence record

MediumCVE-2023-32106

WP Docs <= 1.9.9 - Reflected Cross-Site Scripting

Published: May 2, 2023

Affected versions: [*, 2.0.0)
Patched versions: 2.0.0

Original Wordfence record

MediumCVE-2024-35696

WP Docs <= 2.1.3 - Reflected Cross-Site Scripting

Published: June 6, 2024

Affected versions: *-2.1.3
Patched versions: 2.1.4

Original Wordfence record

MediumCVE-2024-56288

WP Docs <= 2.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: January 3, 2025

Affected versions: *-2.2.1
Patched versions: 2.2.2

Original Wordfence record

MediumCVE-2026-24990

WP Docs <= 2.2.8 - Missing Authorization

Published: January 21, 2026

Affected versions: *-2.2.8
Patched versions: 2.2.9

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory