CVE-2026-12982 in Document Gallery Plugin
Summary
by MITRE • 07/27/2026
The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/27/2026
The Document Gallery WordPress plugin version 5.1.0 and earlier contains a critical reflected cross-site scripting vulnerability that arises from improper input sanitization and output escaping mechanisms within its unauthenticated ajax endpoint. This flaw exists in the plugin's handling of user-supplied data that is processed through an AJAX action accessible to anonymous users without authentication requirements. The vulnerability stems from the plugin's failure to properly validate and sanitize incoming parameters before incorporating them into HTTP responses, creating an attack surface where malicious scripts can be injected and executed within the context of a victim's browser.
The technical implementation of this vulnerability occurs when an unauthenticated user accesses the plugin's ajax endpoint with crafted malicious input parameters. The plugin processes these inputs without adequate sanitization measures, allowing specially crafted payloads to be reflected back in the HTTP response. When a victim browses to a page containing the malicious link or is tricked into interacting with the vulnerable endpoint, the reflected script executes within their browser session, potentially compromising their security context. This vulnerability specifically targets the plugin's AJAX handler that operates without requiring user authentication, making it particularly dangerous as it can be exploited by anyone with access to the affected WordPress installation.
The operational impact of this reflected XSS vulnerability extends beyond simple script execution, as it can enable attackers to perform various malicious activities within the victim's browser environment. Attackers can leverage this vulnerability to steal session cookies, redirect users to malicious websites, inject malware, or perform actions on behalf of authenticated users if they are logged in. The vulnerability affects unauthenticated users specifically, meaning that even visitors who have not logged into the WordPress site can be targeted through this attack vector. This makes the vulnerability particularly concerning for public-facing WordPress installations where anyone can access the Document Gallery plugin functionality without authentication requirements.
Security professionals should note that this vulnerability aligns with CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') and follows patterns commonly associated with reflected XSS attacks in web applications. The ATT&CK framework categorizes this as a technique for initial access through malicious links or crafted payloads, potentially enabling further exploitation within the compromised user's session. Organizations should implement immediate mitigation strategies including updating to version 5.1.1 or later of the Document Gallery plugin, implementing proper input validation and output escaping mechanisms, and monitoring for suspicious activity related to the affected AJAX endpoint. Additionally, network-based protections such as web application firewalls can provide additional layers of defense against exploitation attempts targeting this specific vulnerability pattern.