WP-Safety
CVE-2026-57695

Document Gallery <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting

highImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
7.2
CVSS Score
7.2
CVSS Score
high
Severity
5.1.1
Patched in
5d
Time to patch

Description

The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Low
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=5.1.0
PublishedJuly 10, 2026
Last updatedJuly 14, 2026
Affected plugindocument-gallery

What Changed in the Fix

Changes introduced in v5.1.1

Loading patch diff...

Source Code

WordPress.org SVN
Vulnerable v5.1.0
Browse source Download .zip
Patched v5.1.1
Browse source Download .zip
Research Plan
Unverified

# Exploitation Research Plan - CVE-2026-57695 ## 1. Vulnerability Summary **CVE-2026-57695** is a stored Cross-Site Scripting (XSS) vulnerability in the **Document Gallery** plugin for WordPress (versions <= 5.1.0). The vulnerability arises from two critical failures: 1. **Broken Access Control on…

Show full research plan

Exploitation Research Plan - CVE-2026-57695

1. Vulnerability Summary

CVE-2026-57695 is a stored Cross-Site Scripting (XSS) vulnerability in the Document Gallery plugin for WordPress (versions <= 5.1.0). The vulnerability arises from two critical failures:

  1. Broken Access Control on Settings Update: The plugin's administrative initialization logic (likely in src/admin/class-admin.php or src/inc/class-setup.php) allows unauthenticated users to trigger an update of the plugin's global options (document_gallery).
  2. Insufficient Output Escaping: Several gallery settings, such as mime_types, descriptions, or custom CSS attributes, are stored in the database and subsequently rendered in the HTML output of the [dg] shortcode or the Document Gallery block without proper escaping (e.g., using esc_attr() or esc_html()).

An unauthenticated attacker can overwrite the plugin's configuration to include malicious JavaScript, which will then execute in the context of any user (including administrators) who visits a page containing a document gallery.

2. Attack Vector Analysis

  • Endpoint: /wp-admin/admin-post.php (or any request triggering admin_init).
  • Vulnerable Action: The settings save handler (likely triggered by a POST request containing the document_gallery parameter).
  • **
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/5a081cbd-5cd9-4740-a720-0e4d8904fc4b?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database