Document Gallery
Monthly
Reflected cross-site scripting in the Dan Rossiter Document Gallery WordPress plugin (all versions up to and including 5.1.0) lets an unauthenticated attacker inject script into a reflected response that executes in a victim's browser when they follow a crafted link. Because the CVSS scope is changed, the injected script can affect resources beyond the vulnerable component (e.g., the surrounding WordPress session context). This flaw was reported by Patchstack; no public exploit code has been identified and it is not listed in CISA KEV at time of analysis.
Reflected cross-site scripting (XSS) in the WordPress Document Gallery plugin before version 5.1.1 allows unauthenticated attackers to inject malicious scripts via an unsanitized parameter in an AJAX action. A publicly available proof-of-concept exploit exists, increasing the immediate risk for sites running affected versions.
Reflected cross-site scripting in the Dan Rossiter Document Gallery WordPress plugin (all versions up to and including 5.1.0) lets an unauthenticated attacker inject script into a reflected response that executes in a victim's browser when they follow a crafted link. Because the CVSS scope is changed, the injected script can affect resources beyond the vulnerable component (e.g., the surrounding WordPress session context). This flaw was reported by Patchstack; no public exploit code has been identified and it is not listed in CISA KEV at time of analysis.
Reflected cross-site scripting (XSS) in the WordPress Document Gallery plugin before version 5.1.1 allows unauthenticated attackers to inject malicious scripts via an unsanitized parameter in an AJAX action. A publicly available proof-of-concept exploit exists, increasing the immediate risk for sites running affected versions.