CVE-2026-84930
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The CatFolders Document Gallery & PDF Library WordPress plugin before version 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone who views the affected post.
Risk Assessment
Risk includes session hijacking of administrators, data theft, defacement, and malware distribution to visitors.
Recommendation
Update the plugin to version 2.0.7 or later. Restrict roles that can publish content and apply the principle of least privilege.
Other vulnerabilities in CatFolders Document Gallery & PDF Library
Original NVD description (English source)
The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone who views the affected post.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS