CVE-2026-39781

The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.

The Document Gallery plugin for WordPress in versions up to and including 5.1.1 is vulnerable to Stored Cross-Site Scripting via the 'dg_thumber_webhook' Action Request Body. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. Exploitation requires that logging be enabled in the plugin's Advanced settings, which is only the default state when WP_DEBUG is true; otherwise an administrator must manually enable it.

The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users.

The Document Gallery WordPress plugin contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during page generation. The flaw affects all versions up to and including 5.1.0.