CVE-2026-74920: Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute

Q: Who can exploit this issue, and who can be targeted?

The affected AJAX action is unauthenticated, so an attacker does not need a WordPress account to submit malicious input. The reflected script can target any visitor, including logged-in administrators.

Q: Which plugin versions are affected?

Document Gallery versions through 5.1.1 are affected. The provided information does not identify a fixed version.

Q: What input is involved in the vulnerability?

The issue involves user-controlled input reflected in an HTML attribute through the data-shortcode attribute. The plugin does not properly sanitize and escape that input before returning it in the AJAX response.

Published Oct 15, 2026

Updated

The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.

Affected Software

1 affected component

WordPress Document Gallery<=5.1.1

Event History

Oct 15, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue, and who can be targeted?

The affected AJAX action is unauthenticated, so an attacker does not need a WordPress account to submit malicious input. The reflected script can target any visitor, including logged-in administrators.

Which plugin versions are affected?

Document Gallery versions through 5.1.1 are affected. The provided information does not identify a fixed version.

What input is involved in the vulnerability?

The issue involves user-controlled input reflected in an HTML attribute through the data-shortcode attribute. The plugin does not properly sanitize and escape that input before returning it in the AJAX response.