The Document Gallery WordPress plugin versions prior to 5.1.1 contain a reflected XSS vulnerability (CWE-79) due to improper sanitization and escaping of user input in an unauthenticated AJAX action response. This flaw allows attackers to inject malicious scripts that execute in the context of users who access the vulnerable AJAX endpoint without authentication. The vulnerability is publicly known and assigned CVE-2026-12982 with a CVSS 3.1 base score of 6.1, indicating medium severity. No official patch or remediation level has been confirmed in the provided data.

Successful exploitation could allow an attacker to execute arbitrary scripts in the browsers of unauthenticated users interacting with the vulnerable AJAX action. This may lead to limited confidentiality and integrity impacts, such as theft of user data or session manipulation. There is no indication of availability impact. The vulnerability affects unauthenticated users, increasing the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users of the Document Gallery plugin should monitor official sources for updates or patches addressing this vulnerability. Until a fix is available, consider disabling or restricting access to the vulnerable AJAX action if possible.