CVE-2026-74920: CWE-79 Cross-Site Scripting (XSS) in Document Gallery

The Document Gallery WordPress plugin versions up to and including 5.1.1 contain a reflected Cross-Site Scripting (CWE-79) vulnerability. This occurs due to improper sanitization and escaping of user input before it is reflected inside an HTML attribute in the response to an unauthenticated AJAX request. An attacker can exploit this vulnerability to execute arbitrary JavaScript in the browsers of visitors, including administrators, potentially leading to session hijacking or other malicious actions.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of any visitor's browser, including logged-in administrators. This can lead to theft of session tokens, defacement, or other malicious actions performed with the privileges of the victim user. The vulnerability affects all visitors who trigger the vulnerable AJAX action.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, consider disabling or restricting access to the vulnerable AJAX action if possible, or applying web application firewall (WAF) rules to block malicious input targeting this vulnerability.