Unauthenticated Cross Site Scripting in Document Gallery by WordPress
CVE-2026-39781

7.1HIGH

Key Information:

Vendor

WordPress
Status
Document Gallery
Vendor
CVE Published:
6 October 2026

What is CVE-2026-39781?

The Document Gallery plugin for WordPress is susceptible to an Unauthenticated Cross Site Scripting (XSS) vulnerability, which can affect versions 5.1.1 and earlier. Attackers can exploit this weakness to inject malicious scripts into the web pages, potentially allowing them to steal sensitive user information or perform other malicious actions. Site administrators and users should ensure they are using the latest version of the plugin to mitigate the risks associated with this security issue.

Affected Version(s)

Document Gallery <= 5.1.1

References

https://patchstack.com/database/wordpress/plugin/document...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

duna | Patchstack Bug Bounty Program
.