Document Gallery CVE-2026-74921

Exploitation requires an authenticated account with the WordPress Contributor role or higher on the target site, and the ability to submit content containing a Document Gallery gallery shortcode whose unsanitized attributes are embedded in a single-quoted HTML attribute. The payload only fires when a higher-privileged user (editor/administrator) subsequently views or reviews the attacker's content (UI:R), so success depends on that review workflow actually occurring. Affected: Document Gallery plugin versions through 5.1.1. Limiting factors: no anonymous/unauthenticated path, required authenticated low-privilege foothold, and mandatory victim interaction by a privileged user.

This is a moderate-severity stored cross-site scripting (XSS) flaw in the Document Gallery WordPress plugin, reported by WPScan with publicly available exploit code (POC=YES), but NOT listed in CISA KEV and with no EPSS score provided in the input - so there is no evidence of active or widespread exploitation, only demonstrated feasibility. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, score 6.8) contains notable internal inconsistencies that should be verified: the description states exploitation is available to 'Contributor role and above' - a low-privilege authenticated user - which maps to PR:L, not the PR:H in the vector; and the C:H/I:H/A:H impact is inflated for a scope-unchanged XSS (A:H in particular is not supported, since XSS does not directly impair availability). This pattern is typical of WPScan ratings that account for the downstream admin-session compromise an XSS can enable. Realistically this is a conditional, multi-precondition issue (attacker needs an authenticated Contributor account AND a higher-privileged user must view the malicious content), so it is a 'patch in normal cadence' item rather than an emergency, despite the public POC. No SSVC decision data was supplied.

An attacker who already holds a Contributor account (self-registered or granted on a multi-author site) creates a post containing a Document Gallery shortcode with a malicious event handler embedded in an unescaped attribute. When an editor or administrator previews or reviews that pending content, the injected JavaScript executes in their authenticated browser session, letting the attacker perform admin-level actions (e.g., creating a rogue admin or injecting a backdoor). A public POC for this injection exists via WPScan.