This vulnerability (CVE-2026-81782) in WP Docs (up to version 2.3.1) involves improper neutralization of input during web page generation, categorized as CWE-79 (Cross-site Scripting). It allows users with subscriber privileges to inject malicious scripts that could lead to partial confidentiality, integrity, and availability impacts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges but user interaction, and scope change.

Successful exploitation could allow an attacker with subscriber-level access to execute arbitrary scripts in the context of the victim's browser session. This can lead to partial disclosure of information, modification of data, and disruption of service. However, the attack requires user interaction and privileges at the subscriber level.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit subscriber privileges and avoid interacting with untrusted content in WP Docs.