WordPress Plugin Vulnerabilities

Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute

Description

The plugin does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.

Proof of Concept

Affects Plugins

Plugin icon
document-gallery
No known fix

References

CVE
CVE-2026-74920

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Pedro Pinho
Submitter
Pedro Pinho
Verified
Yes
WPVDB ID
aa80cef6-b2fd-47ef-bac9-53438aa27573

Timeline

Publicly Published
2026-10-13 (about 2 days ago)
Added
2026-10-13 (about 1 day ago)
Last Updated
2026-10-13 (about 1 day ago)

Other

Published
Title
Published
2026-10-13
Title
Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting
Published
2025-08-17
Title
Slide Puzzle <= 1.0.0 - Reflected Cross-Site Scripting
Published
2022-05-09
Title
External Links in New Window / New Tab < 1.43 - Unauthenticated Stored Cross-Site Scripting
Published
2024-10-24
Title
Nexter Blocks < 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2022-03-01
Title
Mapping Multiple URLs Redirect Same Page <= 5.8 - Reflected Cross-Site Scripting