Executive brief
The CatFolders Document Gallery & PDF Library is a WordPress plugin that allows users to display document galleries. The plugin fails to properly validate a block attribute (titleTag) before using it as an HTML tag name, allowing authors to inject malicious scripts. When visitors view a post containing a crafted gallery block, the injected script executes in their browser, potentially compromising their accounts or stealing sensitive data.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the CatFolders Document Gallery & PDF Library plugin versions before 2.0.7. The plugin does not validate the titleTag block attribute before inserting it directly into HTML output as a tag name. An authenticated user with Author role or higher can craft a block attribute value containing an HTML tag with an event handler (e.g., "img src=x onerror=alert(1)") that bypasses WordPress content filters because it lacks literal <, >, or quote characters. When the post is published and viewed by any visitor, the malicious payload is emitted as HTML, executing the embedded script in the viewer's browser session. The vulnerability requires authentication and author-level privileges to exploit, but the stored payload affects all viewers including administrators.
Affected products
- CatFolders Document Gallery & PDF Library before 2.0.7
Timeline
- 2026-09-03: disclosed
- 2026-09-05: patched: Version 2.0.7 released