CVE-2026-77114
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Document Gallery plugin for WordPress in versions up to and including 5.1.1 is vulnerable to Stored Cross-Site Scripting via the 'dg_thumber_webhook' Action Request Body. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. Exploitation requires that logging be enabled in the plugin's Advanced settings, which is only the default state when WP_DEBUG is true; otherwise an administrator must manually enable it.
Risk Assessment
An attacker can execute arbitrary JavaScript in a user's or administrator's browser, potentially leading to session theft or account takeover. The risk is moderate because it requires logging to be enabled, but it may be active by default in development environments.
Recommendation
Update the Document Gallery plugin to a version later than 5.1.1 as soon as it becomes available. Check whether logging in Advanced settings is unnecessarily enabled and disable it if possible.
Other vulnerabilities in Document Gallery
See all- CVE-2026-74920High
The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.
- CVE-2026-39781High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery (document-gallery) allows Reflected XSS. This issue affects Document Gallery through version 5.1.1.
- CVE-2026-12982Medium
The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users.
- CVE-2026-57695High
The Document Gallery WordPress plugin contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during page generation. The flaw affects all versions up to and including 5.1.0.
Original NVD description (English source)
The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action Request Body in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that logging be enabled in the plugin's Advanced settings, which is only the default state when WP_DEBUG is true; otherwise an administrator must manually enable it.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS