WP Docs · Version history
WP Docs changelog and version history
- Latest version
- 2.3.6
- Nov 2, 2026 (6 days ago)
- Releases
- 17
- since 2024
- In the last year
- 8
- about one every 41 days
- Tested up to
- WordPress 7.1.4
- PHP 7.4 or later
Releases each year
- 20243 releases
- 20256 releases
- 20268 releases
20268 releases
WP Docs 2.3.6Latest
- Security: Fixed authenticated (Contributor+) SQL Injection via the [wpdocs] shortcode ‘orderby’ and ‘order’ attributes (CVE-2026-120504). Reported by Wordfence PRISM.
- Security: ORDER BY column and direction are now allow-listed (title, date, modified, name, ID, menu_order / ASC, DESC); all other values fall back to safe defaults.
- Security: Folder queries now use fully prepared placeholders for post status, post types and parent IDs.
- Security: Front-end navigation nonce checks are now fail-closed; omitting the nonce key no longer skips verification (free and premium).
- Fix: Recursive folder listing now matches every parent ID instead of only the first.
- Compatibility: Tested up to WordPress 7.1; PHP 7.4+.
- Update immediately if your site allows Contributor or Author accounts.
WP Docs 2.3.5
- Security: Premium (pro) AJAX handlers now check capabilities and require a valid nonce (fail-closed).
- Security: Premium download links now use the same nonce-protected secure handler as the free version.
- Security: Mobile app (QR) REST login key validation fixed; keys are random, compared in constant time, QR hashes expire and are single use.
- Security: Directory ZIP download and reset actions restricted to authorised admin users; HTML/SVG files are always served as attachments.
- Security: Prepared SQL placeholders, escaped output, sanitised colour settings.
- Compatibility: Tested up to WordPress 7.1; PHP 7.4+.
- New (Premium, optional “pro” folder): Download statistics and activity log with CSV export, folder ZIP download shortcode [wpdocs_zip], front-end document search shortcode [wpdocs_search].
- The free version works exactly as before when the “pro” folder is not present.
WP Docs 2.3.4
- Security: Fixed Stored XSS (CVE-2026-81782) — hardened sanitize_wpdocs_data() and added esc_html/esc_attr/esc_url output escaping across frontend and admin views. * Security: Added capability checks to wpdocs_add_files, wpdocs_delete_files, wpdocs_update_folder; removed nopriv from wpdocs_update_vi…
WP Docs 2.3.3
WP Docs 2.3.2
WP Docs 2.3.1
- Enhancement: Added Memphis Documents Library verification tool to check imported files and folders integrity, “Import Missing Items Only” button, clickable folder links in verification tree, and full localization support. [Thanks to Teboho Ramonyaluoa][2026-06-05]
WP Docs 2.3.0
- Security: Escaped all dynamic attributes and text in the folder
- output for XSS safety using esc_attr() and esc_html__().
WP Docs 2.2.9
- Security: Fixed Broken Access Control in AJAX handlers wpdocs_create_folder and wpdocs_delete_folder by adding proper capability checks (manage_options). [Thanks to hhhai / Patchstack]
- Fix: Deleting unused folder in WP Docs. [Thanks to Jordan Wells / gclna.org]
20256 releases
WP Docs 2.2.8
- Fix: Deleting unused folder in WP Docs. [Thanks to Jordan Wells / gclna.org]
WP Docs 2.2.7
WP Docs 2.2.6
WP Docs 2.2.5
- Fix: Imagick related exceptions added. [Thanks to James Oliver / Paluma]
WP Docs 2.2.4
WP Docs 2.2.3
20243 releases
WP Docs 2.2.2
- Fix: Discovered and reported this Cross Site Scripting (XSS) vulnerability in directory renaming functionality. [Thanks to b4orvn / Patchstack]
WP Docs 2.2.1
- Fix: $wpdb->prepare() for every database query that is not completely hard-coded and accepts user-supplied input to prevent SQL injection. [Thanks to Arkadiusz Hydzik / Peter Greaves / Wordfence]
WP Docs 2.2.0
Questions about WP Docs’s releases
What is the latest version of WP Docs?
2.3.6, released on Nov 2, 2026 (6 days ago). It’s tested up to WordPress 7.1.4 and needs PHP 7.4 or later.
How often is WP Docs updated?
8 releases in the last year, about one every 41 days. Its first release on WordPress.org dates from December 2024.
Know when your rivals ship
Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.
Start freeRelease dates come from the day each version’s folder was made in WP Docs’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.