MEDIUM 6.8 NVD

CVE-2026-74921

The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HT

The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when a higher privileged user views the content.

References

https://wpscan.com/vulnerability/b0b97661-c671-420c-8fca-22666862b379/

Published: 2026-10-19 · Source: NVD · Feed updated: 2026-10-19

This medium severity vulnerability with a CVSS score of 6.8 was published on 2026-10-19 via NVD.

vulnfeed aggregates 17512 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.