CVE-2026-74921: medium-severity vulnerability in Document Gallery
Document Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode Attributes
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.8epss 0.2%
The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when a higher privileged user views the content.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · Document Gallerypublic PoCs found — 1
cve_referencewpscan.com/vulnerability/b0b97661-c671-420c-8fca-22666862b379/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Document Gallery
In the same product, most dangerous first.
CVE-2026-12982MEDIUMDocument Gallery < 5.1.1 - Reflected XSS via dg_generate_galleryEPSS 0.3%CVE-2026-74923MEDIUMDocument Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_iconsEPSS 0.2%CVE-2026-74920HIGHDocument Gallery <= 5.1.1 - Reflected XSS via data-shortcode AttributeEPSS 0.1%CVE-2026-74922MEDIUMDocument Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature BypassEPSS 0.1%