UNKNOWN NVD

CVE-2026-74920

The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the respon

The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.

References

https://wpscan.com/vulnerability/aa80cef6-b2fd-47ef-bac9-53438aa27573/

Published: 2026-10-15 · Source: NVD · Feed updated: 2026-10-15

This unknown severity vulnerability was published on 2026-10-15 via NVD.

vulnfeed aggregates 13758 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.