CVE-2026-74920
Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.
| Vendor | unknown |
| Product | document gallery |
| Published | Oct 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown document gallery
Be the first to know when new unknown vulnerabilities affecting unknown document gallery are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Document Gallery
0 ≤ 5.1.1
References
Credits
Pedro Pinho WPScan