CVE-2026-12982

MEDIUM

Document Gallery < 5.1.1 - Reflected XSS via dg_generate_gallery

Title source: cna

Description

The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users.

References (1)

Core 1

Core References

Exploit exploit vdb-entry technical-description

https://wpscan.com/vulnerability/a3c279ce-5db1-4331-ad74-4eef49619737/

Scores

CVSS v3 6.1

EPSS 0.0016

EPSS Percentile 5.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

None/Document Gallery < 5.1.1

Published Jul 27, 2026

Tracked Since Jul 27, 2026