Security Alert Summary
The Document Gallery WordPress plugin through 5.1.1 fails to properly sanitize and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action. This leads to a reflected Cross-Site Scripting (XSS) vulnerability that can be triggered against any site visitor, including logged-in administrators.
CVE Details
- CVE ID: CVE-2026-74920
- Affected component: Document Gallery WordPress plugin
- Affected versions: through 5.1.1
- Published: October 15, 2026 at 7:18:02 AM
- Last modified: October 15, 2026 at 2:47:05 PM
- CVSS v3.1 base score: 7.1
- CVSS v3.1 severity: HIGH
- CVSS v3.1 vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
- Authentication / privileges / user interaction:
- Privileges required: None
- User interaction: Required
- Attack vector: Network
- Attack complexity: Low
- Scope: Changed
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: Low
- Weakness (CWE): CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The plugin reflects user-supplied input inside an HTML attribute in the response to an unauthenticated AJAX action without proper sanitization or escaping. Because the input is reflected into an attribute context, an attacker can craft a URL or request that causes the malicious payload to be returned and interpreted by the victim’s browser.
The vulnerability exists in the handling of an unauthenticated AJAX action response where user input is not neutralized before being embedded into HTML. The CVE description specifies the reflection into an HTML attribute and identifies the issue as a reflected Cross-Site Scripting vector. The flaw can be triggered by visiting a crafted link or by an attacker causing a victim to load a page or request that returns the crafted response.
Impact is limited to what can be achieved via script execution in the context of a victim’s browser session. The CVE notes the issue can be exploited against any visitor, including logged-in administrators; however, the provided metrics indicate low confidentiality, integrity, and availability impacts at the component level.
How This Could Impact Your Website
Imagine a site owner managing content while internal staff and an external contractor also have accounts. An attacker could send a crafted link to a staff member or contractor. If the recipient opens the link, the reflected XSS payload can execute in their browser. For a logged-in user, that script could interact with pages they can view, potentially reading visible data and sending it to the attacker.
Practical consequences include exposure of page content or user-visible data such as email addresses, increased risk of targeted phishing or social engineering, and unauthorized actions being performed in a victim’s browser context. The vulnerability does not, by itself, imply full site takeover, but it does increase risk where privileged users are targeted.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and editor accounts that are not needed.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your installation.
- Monitor site activity and logs for unusual behavior, such as unexpected AJAX requests or unfamiliar referrers.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
