6.1
Medium
CVE-2026-12982 The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it…
Description
The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Document Gallery 5.1 | earliest → < 5.1.1 | 5.1.1 |
Other CVEs of Document Gallery
The 5 CVEs of Document Gallery →
CVE-2026-74922
The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated…
5.3
Medium
CVE-2026-74921
The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes…
6.8
Medium
CVE-2026-74923
The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a…
5.3
Medium
CVE-2026-74920
The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting…
7.1
High