Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-74921— Document Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode Attributes

Quick assessment

Affected
Unknown Document Gallery
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件 Document Gallery 在 5.1.1 版本及之前，未对多个画廊短代码属性进行清理或转义，便将其嵌入到渲染后的画廊标记中单引号包裹的 HTML 属性内。这使得拥有“投稿者（Contributor）”及以上权限的用户能够注入任意事件处理程序，当高权限用户查看该内容时，这些恶意代码将被执行。

CVSS 6.8 · Medium EPSS 0.24% · P14

Affected Version Matrix 1

VendorProduct Version RangeStatus
Unknown Document Gallery 4.0≤ 5.1.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74921

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Document Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode Attributes
Source: CVE Program / CVE List V5
Vulnerability Description
The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when a higher privileged user views the content.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown Document Gallery 4.0 ~ 5.1.1 -

II. Public POCs for CVE-2026-74921

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74921

请登录查看更多情报信息。

Same Patch Batch · Unknown · 2026-10-19 · 20 CVEs total

CVE-2026-94231 5.3 MEDIUM TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creati
CVE-2026-94272 5.3 MEDIUM Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple A
CVE-2026-94230 5.3 MEDIUM TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbit
CVE-2026-94229 5.3 MEDIUM TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via
CVE-2026-94228 5.3 MEDIUM TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite v
CVE-2026-86791 5.3 MEDIUM iPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation Fo
CVE-2026-74922 5.3 MEDIUM Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber
CVE-2026-94294 5.3 MEDIUM App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.ph
CVE-2026-103311 5.3 MEDIUM Coinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Webhook Signa
CVE-2026-106010 5.3 MEDIUM BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery
CVE-2026-91831 3.8 LOW Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting
CVE-2026-110034 3.7 LOW Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code
CVE-2026-94273 Snap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_com
CVE-2026-89286 FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File
CVE-2026-106014 Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment C
CVE-2026-91047 ElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass
CVE-2026-106933 Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload
CVE-2026-91046 ElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Mi
CVE-2026-106028 ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation

IV. Related Vulnerabilities

Same product: Document Gallery
Same vendor: Unknown

V. Comments for CVE-2026-74921

No comments yet

Leave a comment