{"id":"CVE-2026-74921","kind":"vulnerability","aliases":["CVE-2026-74921"],"related":[],"title":"WordPress Document Gallery plugin: shortcode attributes allow stored XSS","description":"The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when a higher privileged user views the content.","summary":"The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before writing them into HTML. A contributor-level user can inject event handlers that run in the browser of a higher-privileged user who views the page.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["only-administrators-write-content","plugin-not-installed"],"how_to_check":"- Check the installed version of the Document Gallery plugin in the WordPress admin plugins list or `wp plugin get document-gallery --field=version`\n- Look for the plugin's gallery shortcode in posts and pages that contributors can edit\n- Confirm which accounts hold the Contributor role or above on the site","fix":"- Update the Document Gallery plugin to a version later than `5.1.1`, if the vendor has released one (unknown from the sources)\n- Until patched, restrict Contributor and above accounts or remove the plugin's gallery shortcode","status":"open","published_at":"2026-10-19T07:16:31+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:44:53+00:00","updated_at":"2026-10-25T03:44:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:44:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Document Gallery plugin to a version later than `5.1.1`, if the vendor has released one (unknown from the sources)\n- Until patched, restrict Contributor and above accounts or remove the plugin's gallery shortcode","reach":"internet","title":"WordPress Document Gallery plugin: shortcode attributes allow stored XSS","impact":"medium","summary":"The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before writing them into HTML. A contributor-level user can inject event handlers that run in the browser of a higher-privileged user who views the page.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Injected script runs in an editor or admin's browser session","analyst_note":"Check the Document Gallery plugin changelog or the NVD entry for a fixed version above 5.1.1 and confirm the exact vulnerable shortcode attributes.","how_to_check":"- Check the installed version of the Document Gallery plugin in the WordPress admin plugins list or `wp plugin get document-gallery --field=version`\n- Look for the plugin's gallery shortcode in posts and pages that contributors can edit\n- Confirm which accounts hold the Contributor role or above on the site","needs_analyst":true,"not_affected_if":["plugin-not-installed","only-administrators-write-content"],"who_is_affected":"Sites running the Document Gallery WordPress plugin version 5.1.1 or earlier where users with Contributor or higher roles can create content with the gallery shortcode. The exposure is stored script execution against editors and administrators who view that content. Sites without the plugin, or where only trusted administrators write content, face less practical risk.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000669,"input_tokens":3334,"output_tokens":671,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-74921':12A,15A '5.1.1':30B,75C 'allow':7A,100C 'arbitrari':110C 'attribut':6A,39B,84C,94C 'browser':58B 'content':122C 'contributor':47B,104C 'contributor-level':46B 'cve':10A,13A 'document':2A,25B,70C 'embed':86C 'escap':35B,80C 'event':52B,111C 'execut':114C 'galleri':3A,26B,37B,71C,82C,98C 'handler':53B,112C 'higher':62B,117C 'higher-privileg':61B 'host':19B 'html':44B,93C 'inject':51B,109C 'level':48B 'markup':99C 'packag':16B 'page':68B 'plugin':4A,23B,28B,73C 'privileg':63B,118C 'quot':92C 'render':97C 'role':105C 'run':55B 'sanitis':33B,78C 'self':18B 'self-host':17B 'sever':36B,81C 'shortcod':5A,38B,83C 'singl':91C 'single-quot':90C 'store':8A 'user':49B,64B,101C,119C 'view':66B,120C 'wordpress':1A,20B,22B,27B,72C 'wordpress-plugin':21B 'write':41B 'xss':9A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Document Gallery WordPress plugin version 5.1.1 or earlier where users with Contributor or higher roles can create content with the gallery shortcode. The exposure is stored script execution against editors and administrators who view that content. Sites without the plugin, or where only trusted administrators write content, face less practical risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T07:16:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-74921","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74921","severity":null,"published_at":"2026-10-19T07:16:31+00:00","modified_at":"2026-10-19T21:02:51+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}