Document Gallery CVE-2026-39781

Exploitation targets the Document Gallery WordPress plugin at version 5.1.1 or earlier and requires no authentication (PR:N), but it does require victim user interaction (UI:R) - a user must open a crafted link or view attacker-influenced gallery content for the injected script to execute in their browser. The limiting factors are therefore the need for social-engineering/user interaction and the requirement that the vulnerable plugin be installed and the affected code path reachable; impact is bounded by the browser's same-origin context of the WordPress site rather than the server itself. The exact vulnerable parameter/feature is not named in the available description.

This is a moderate-severity unauthenticated XSS (CWE-79) in the Document Gallery WordPress plugin (<=5.1.1), reported by Patchstack with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The network vector, low complexity, and no-privilege requirements make it easy to reach, but the UI:R flag means a victim must perform an action (e.g. clicking a crafted link or viewing attacker-influenced content), which meaningfully reduces the likelihood of automated mass exploitation. No EPSS score, CISA KEV listing, or public POC was provided in the source data, so there is no evidence of active exploitation or weaponization - the elevated 7.1 is driven largely by the scope-change (S:C) and the assumption of low impact across C/I/A, which is somewhat generous for a typical reflected/stored XSS (availability impact on XSS is debatable). Overall this reads as a real but routine web-application vulnerability to patch on a normal cycle rather than an emergency: no public exploit identified at time of analysis, exploitation requires user interaction, and the real-world ceiling is session/credential theft or action-forgery within the affected site rather than direct server compromise. Note the A:L in the input vector is questionable for XSS - see the assessed vector below.

An unauthenticated attacker crafts a malicious URL or payload targeting the vulnerable Document Gallery input, then lures a logged-in site visitor or administrator into viewing it. When the victim's browser renders the unsanitized content, attacker-controlled JavaScript executes in the site's origin, enabling session cookie theft, credential harvesting, or forged privileged actions. No public exploit code was identified at time of analysis, and the attack depends on the victim interacting with the crafted content (UI:R).