Executive brief
The Document Gallery plugin for WordPress, which is used to manage and display document libraries on websites, contains a security flaw. An attacker can trick a user into clicking a malicious link, allowing the attacker to run unauthorized scripts in the user's browser. This could lead to the theft of login cookies or sensitive information from the user's session.
Technical details
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Document Gallery WordPress plugin before version 5.1.1. The flaw is located within the 'dg_generate_gallery' AJAX action, which fails to properly sanitize and escape user-supplied input before reflecting it in the server's response. An unauthenticated remote attacker can exploit this by crafting a malicious URL and tricking a user into visiting it. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session. The issue is resolved in version 5.1.1.
Affected products
- Unknown Document Gallery < 5.1.1
Timeline
- 2026-07-06: disclosed: Publicly published by WPScan
- 2026-07-27: advisory: NVD published date
- 2026-07-27: patched: Fixed in version 5.1.1