CVE-2026-3878 is a stored cross-site scripting vulnerability in the WP Docs plugin for WordPress, affecting all versions up to and including 2.2.9. The issue occurs due to improper neutralization of input in the 'wpdocs_options[icon_size]' parameter, allowing authenticated users with subscriber-level privileges or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the injected content. The vulnerability is classified under CWE-79 and has a CVSS 3.1 score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and limited confidentiality and integrity impacts without availability impact. No vendor advisory or patch is currently documented.

An attacker with subscriber-level or higher access can inject persistent malicious scripts into pages via the vulnerable parameter. This can lead to execution of arbitrary scripts in the context of other users viewing those pages, potentially resulting in session hijacking, information disclosure, or other client-side impacts. The vulnerability does not affect availability and has limited confidentiality and integrity impact as per the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and monitor for suspicious activity related to the WP Docs plugin. Avoid granting unnecessary privileges to untrusted users. Consider disabling or removing the WP Docs plugin if it is not essential.