Document Gallery EUVD-2026-101853

Exploitation targets the unauthenticated AJAX action exposed by the Document Gallery plugin (versions up to and including 5.1.1), where a user-supplied parameter is reflected without proper sanitization/escaping inside an HTML attribute. The decisive limiting factor is required user interaction (UI:R): a victim - ideally a logged-in administrator - must click or load the attacker-crafted link, so there is no silent server-side compromise. No authentication is required of the attacker to deliver the payload (PR:N), and the endpoint is reachable over the network against default installations of the plugin, but impact is confined to script execution in the victim's browser session, not direct server control.

This is a genuine but moderate-priority issue rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1 High) indicates a network-reachable, low-complexity flaw requiring no privileges, consistent with the description of an unauthenticated AJAX action. The scope change (S:C) and the three Low impacts reflect classic reflected XSS mechanics where script executes in the victim's browser context rather than the server. Publicly available exploit code exists (reported by WPScan), which raises practical risk, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - exploitation code availability and active exploitation are distinct signals and should not be conflated. The key limiting factor is UI:R: the attacker must induce a victim (ideally a logged-in administrator) to click a crafted link, so this is not a drive-by, wormable, or server-side RCE condition. Net assessment: a credible, easily weaponized XSS worth patching promptly on affected sites, but not a mass-exploitation crisis. Missing data: no EPSS probability and no KEV entry to corroborate real-world exploitation volume.

An attacker crafts a URL to the plugin's unauthenticated AJAX endpoint with a malicious payload in a parameter that is reflected unescaped inside an HTML attribute, then sends it to a site administrator via phishing or a comment link. When the logged-in admin opens the link, the injected JavaScript executes in their authenticated session, enabling session/cookie theft or admin actions such as creating rogue users. A public proof-of-concept is already available via WPScan, lowering the skill barrier to reproduce the attack.