CVE-2026-39781: WordPress Document Gallery plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The issue is unauthenticated, so no WordPress account or prior privileges are required. Exploitation still requires user interaction, as indicated by the UI:R vector.

Q: What impact could successful exploitation have?

Successful exploitation can affect confidentiality, integrity, and availability at a low impact level, and its scope can extend beyond the vulnerable component (S:C).

Q: Which plugin versions are affected?

Document Gallery versions 5.1.1 and earlier are affected. The provided data does not identify a fixed version.

Published Oct 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Document Gallery <= 5.1.1 versions.

Affected Software

1 affected component

WordPress Document Gallery<=5.1.1

Event History

Oct 6, 2026

CVE Published

via MITRE·08:34 AM

Data Sourced

via MITRE·08:34 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The issue is unauthenticated, so no WordPress account or prior privileges are required. Exploitation still requires user interaction, as indicated by the UI:R vector.

What impact could successful exploitation have?

Successful exploitation can affect confidentiality, integrity, and availability at a low impact level, and its scope can extend beyond the vulnerable component (S:C).

Which plugin versions are affected?

Document Gallery versions 5.1.1 and earlier are affected. The provided data does not identify a fixed version.

CVE-2026-39781: WordPress Document Gallery plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What impact could successful exploitation have?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What impact could successful exploitation have?

Which plugin versions are affected?