CVE-2026-74920 — Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute

CVE-2026-74920

Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute PUBLISHED

Description (CNA)

The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.

Affected (CNA)

Vendor / product	Versions
Unknown / Document Gallery	affected 0 through 5.1.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/aa80cef6-b2fd-47ef-bac9-53438aa27573/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.