Stored Cross-Site Scripting in Document Gallery Plugin for WordPress

CVE-2026-77114

What is CVE-2026-77114?

The Document Gallery plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through the 'dg_thumber_webhook' action request body. This flaw arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject malicious web scripts that execute on user pages. Successful exploitation is contingent upon logging being activated in the plugin's Advanced settings, a state typically achieved when WP_DEBUG is enabled or manually set by an administrator.

References