CVE-2026-12982
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users.
Risk Assessment
An attacker can send a specially crafted link to a victim, which upon clicking executes a malicious script in their browser, potentially stealing sessions or data.
Recommendation
Update the Document Gallery plugin to version 5.1.1 or later.
Other vulnerabilities in Document Gallery
Original NVD description (English source)
The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users.