CVE-2026-84930
CatFolders Document Gallery < 2.0.7 - Author+ Stored XSS via titleTag Block Attribute
CVSS Score
6.8
EPSS Score
0.0%
EPSS Percentile
0th
The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone who views the affected post.
| Vendor | unknown |
| Product | catfolders document gallery & pdf library |
| Published | Sep 5, 2026 |
| Last Updated | Sep 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown catfolders document gallery & pdf library
Be the first to know when new medium vulnerabilities affecting unknown catfolders document gallery & pdf library are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / CatFolders Document Gallery & PDF Library
0 < 2.0.7
References
Credits
Artus KG WPScan