Document Gallery EUVD-2026-100789

Exploitation requires the Document Gallery plugin's logging option (Advanced settings) to be active, which is the default state only when WP_DEBUG is set to true; on normal production sites an administrator must have manually enabled logging, so default installations are not affected. The injected payload is stored via the 'dg_thumber_webhook' action request body and executes when a user (typically an administrator) subsequently accesses the page/log where the content is rendered, so the primary limiting factors are the non-default logging configuration and the need for a privileged user to view the affected page; no authentication is required to inject the payload.

The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) presents this as a network-reachable, unauthenticated, low-complexity stored XSS with scope change, which on paper is a high priority. However, the description introduces a significant mitigating precondition the CVSS score does not reflect: exploitation requires the plugin's logging feature to be enabled in Advanced settings, which is only the default when WP_DEBUG is true and otherwise must be manually turned on by an administrator. This conflicts with the AC:L rating - a non-default configuration dependency realistically warrants higher attack complexity, so the real-world attack surface is narrower than 7.2 suggests. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public exploit code is referenced, meaning there is no public exploit identified at time of analysis. Net assessment: this is a genuine unauthenticated stored XSS but is conditionally exploitable rather than broadly exploitable, making it a moderate rather than urgent priority for most deployments, with elevated priority only on sites running WP_DEBUG or that have manually enabled plugin logging.

An attacker sends a crafted request to the 'dg_thumber_webhook' action on a WordPress site running Document Gallery <=5.1.1 with logging enabled; the unsanitized request body is written into the plugin's log. When an administrator later views the logging tab, the injected script executes in their authenticated browser session, enabling cookie theft, admin-account actions, or further site compromise. No public proof-of-concept is referenced in the provided data.