WordPress security by component
Document Gallery
Plugin description
Document Gallery is a WordPress component with 2 published CVE records in this archive. The latest tracked vulnerability was published Jul 27, 2026; the highest CVE/CNA score is 7.1.
Plugin slug:
document-galleryLatest vulnerability
CVE-2026-12982: Document Gallery AJAX output permits unauthenticated reflected XSS
Document Gallery before 5.1.1 exposes an unauthenticated AJAX action that reflects attacker-controlled input without sufficient sanitization and output escaping. An attacker can construct a request that executes script in the affected site's origin when a victim follows or submits it. The CNA record does not disclose the AJAX action, parameter or rendering function.
| Safe version |
|
||
|---|---|---|---|
| Jul 27, 2026 |
CVE-2026-12982
Document Gallery AJAX output permits unauthenticated reflected XSS
Document Gallery before 5.1.1 exposes an unauthenticated AJAX action that reflects attacker-controlled input without sufficient sanitization and output escaping. An attacker can construct a request that executes script in the affected site's origin when a victim follows or submits it. The CNA record does not disclose the AJAX action, parameter or rendering function.
|
5.1.1 |
CVE6.1
NVDPending
|
| Jul 13, 2026 |
CVE-2026-57695
Document Gallery: Cross-site scripting
Document Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 5.1.0.
|
5.1.1 |
CVE7.1
NVDPending
|