CVE-2026-74921: CWE-79 Cross-Site Scripting (XSS) in Document Gallery

The Document Gallery WordPress plugin versions 4.0 through 5.1.1 contain a CWE-79 XSS vulnerability due to improper sanitization and escaping of gallery shortcode attributes. These attributes are embedded in single-quoted HTML attributes in the gallery markup, enabling users with Contributor or higher privileges to inject malicious event handlers. When a user with higher privileges views the gallery, the injected handlers execute, potentially compromising confidentiality, integrity, and availability.

Successful exploitation allows an attacker with Contributor or higher privileges to execute arbitrary script code in the context of higher privileged users who view the gallery content. This can lead to full compromise of the affected user's session, data theft, or further attacks within the WordPress environment. The CVSS 3.1 score of 6.8 reflects a medium severity with high impact on confidentiality, integrity, and availability, requiring user interaction and elevated privileges to exploit.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict Contributor role assignments and avoid exposing galleries to higher privileged users. Review and sanitize user input manually if possible to reduce risk.