CVE-2026-77114: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in danrossiter Document Gallery

CVE-2026-77114 is a stored Cross-Site Scripting vulnerability in the Document Gallery plugin for WordPress, affecting all versions up to and including 5.1.1. The issue arises from insufficient input sanitization and output escaping of the 'dg_thumber_webhook' action request body. An unauthenticated attacker can inject arbitrary web scripts that execute in the context of users visiting the injected pages. Exploitation depends on the plugin's logging feature being enabled, which is not enabled by default unless WP_DEBUG is set to true or an administrator enables logging manually.

Successful exploitation can lead to the execution of arbitrary scripts in the context of users visiting the affected pages, potentially allowing theft of user credentials, session hijacking, or other malicious actions limited to the scope of the injected script. The vulnerability does not require authentication but does require that logging be enabled in the plugin settings. There is no indication of active exploitation in the wild.

No official patch or fix is currently documented. Administrators should disable the logging feature in the plugin's Advanced settings if it is enabled, especially if WP_DEBUG is true. Monitor the vendor's advisory channels for updates or patches addressing this vulnerability. Until a fix is available, avoid enabling logging unless necessary and restrict access to the affected plugin functionality.