CVE-2026-74920— Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute
Quick assessment
Affected
Unknown Document Gallery
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 插件 Document Gallery 在 5.1.1 版本及更早版本中，在对未认证的 AJAX 动作的响应中，在 HTML 属性内反射用户输入之前，未正确对用户输入进行清理和转义，从而导致了一个反射型跨站脚本（Reflected Cross-Site Scripting, XSS）漏洞。该漏洞可被针对任何访问者利用，包括已登录的管理员用户。
Possible ATT&CK Techniques 1 AI
T1059.007 · JavaScriptAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Document Gallery | ≤ 5.1.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-74920
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute
Source: CVE Program / CVE List V5
Vulnerability Description
The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Document Gallery | 0 ~ 5.1.1 | - |
|
II. Public POCs for CVE-2026-74920
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-74920
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-15 · 9 CVEs total
| CVE-2026-92429 | 5.3 MEDIUM | Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via ma |
| CVE-2026-92428 | 5.3 MEDIUM | Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Fail |
| CVE-2026-103324 | 5.3 MEDIUM | Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order |
| CVE-2026-96537 | Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite | |
| CVE-2026-109145 | User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Regist | |
| CVE-2026-106031 | Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result | |
| CVE-2026-104643 | Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide UR | |
| CVE-2026-103304 | eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update |
IV. Related Vulnerabilities
Same product: Document Gallery
-
CVE-2026-77114
Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Sit -
CVE-2026-39781
WordPress Document Gallery plugin <= 5.1.1 - Cross Site Scri -
CVE-2026-12982
Document Gallery < 5.1.1 - Reflected XSS via dg_generate_gal -
CVE-2026-57695
WordPress Document Gallery plugin <= 5.1.0 - Cross Site Scri
Same vendor: Unknown
-
CVE-2026-92429
Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Or -
CVE-2026-92428
Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order St -
CVE-2026-103324
Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Un -
CVE-2026-96537
Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish -
CVE-2026-109145
User Rights Access Manager <= 1.1.3 - Unauthenticated Privil
V. Comments for CVE-2026-74920
No comments yet