CVE-2026-74920 in Document Gallery Plugin
Summary
by MITRE • 10/15/2026
The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The Document Gallery WordPress plugin versions through 5.1.1 contains a critical security flaw classified as a reflected cross-site scripting vulnerability. This issue stems from insufficient sanitization and escaping of user-supplied input before it is embedded within HTML attributes in the server's response to an unauthenticated AJAX request. The core technical failure lies in the application logic, which accepts external data without validating its structure or encoding special characters that hold meaning in HTML contexts. When this unsanitized data is reflected back into the page content inside attribute values, such as href or src tags, it allows for the injection of malicious scripts. Because the vulnerability exists within an unauthenticated AJAX endpoint, any internet user can trigger the payload without needing to log in, making the attack surface significantly broader than vulnerabilities restricted to authenticated administrative interfaces.
From a classification perspective, this flaw aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism here is reflected XSS, where the malicious script is immediately returned by the web application in response to a request rather than being stored for later execution. This distinction is important because it requires active exploitation against individual victims or relies on social engineering tactics such as phishing links sent via email or instant messaging services. An attacker can craft a URL containing JavaScript code within query parameters that target specific input fields processed by the Document Gallery plugin's AJAX handler. When a victim visits this crafted link, their browser executes the injected script in the context of the vulnerable website, granting the attacker access to session cookies, authentication tokens, or other sensitive data stored locally for that domain.
The operational impact of this vulnerability is severe due to its unauthenticated nature and broad applicability. Since any visitor can exploit it, including logged-in administrators, an attacker could potentially hijack administrative sessions if a site administrator clicks on a malicious link while authenticated. This session hijacking capability allows the adversary to perform actions with elevated privileges, such as modifying plugin settings, installing additional malware plugins, or altering website content. Furthermore, reflected XSS attacks are often used for credential harvesting through fake login forms that mimic legitimate WordPress interfaces, leading to direct compromise of user accounts and subsequent control over the entire web application infrastructure. The lack of authentication requirements means there is no access control barrier preventing initial exploitation attempts from anonymous sources.
Mitigation strategies must address both immediate remediation and long-term defensive posture improvements. The primary solution involves upgrading the Document Gallery plugin to a version newer than 5.1.1 where this specific input validation issue has been resolved by developers implementing proper output encoding functions such as esc_attr in PHP environments for WordPress plugins. Until an update is applied, administrators should consider disabling AJAX functionality related to document galleries if possible or restricting access to those endpoints via firewall rules that limit source IPs to trusted networks only. Additionally, deploying a Web Application Firewall can help detect and block common XSS payloads by analyzing request patterns for suspicious characters like angle brackets and quotation marks within parameter values. Implementing Content Security Policy headers is also recommended as an additional layer of defense to restrict the sources from which scripts can be executed, thereby mitigating the impact even if some script injection occurs. Regular security audits and code reviews focusing on input validation practices are essential to prevent similar vulnerabilities in future development cycles.