CVE-2026-39781
HighCVSS 7.1Summary
The Document Gallery plugin in versions up to 5.1.1 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.
Risk Assessment
An attacker can inject malicious script that executes in the user's browser, potentially leading to session or data theft. The risk affects all installations of the plugin version 5.1.1 and earlier.
Recommendation
Update the Document Gallery plugin to the latest version that does not contain the vulnerability. If updating is not possible, consider disabling the plugin until it is fixed.
Other vulnerabilities in Document Gallery
See all- CVE-2026-12982Medium
The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users.
- CVE-2026-57695High
The Document Gallery WordPress plugin contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during page generation. The flaw affects all versions up to and including 5.1.0.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Document Gallery <= 5.1.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS