Document Gallery WordPress Plugin DOM XSS via Shortcode Attributes

Executive Summary

This vulnerability is in the Document Gallery WordPress plugin version 5.1.1 or earlier. It allows users with Contributor role or higher to inject malicious event handlers into gallery shortcode attributes. These attributes are not properly sanitized or escaped before being rendered in HTML, which can execute arbitrary code when a higher-privileged user views the content.

Useful 0 Not Useful 0

Detection Guidance

Check WordPress installations for the Document Gallery plugin version 5.1.1 or below. Inspect rendered gallery markup for unsanitized shortcode attributes containing event handlers like onerror or onclick. Review user roles with Contributor access or higher for suspicious content submissions.

Useful 0 Not Useful 0

Impact Analysis

An attacker with Contributor access or higher could exploit this to run malicious scripts in the browser of a logged-in admin or other high-privilege user. This could lead to unauthorized actions, data theft, or further compromise of the WordPress site.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Non-compliance risks include fines, legal action, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Document Gallery plugin to the latest version. Remove or restrict Contributor role permissions if not required. Implement input validation for shortcode attributes. Monitor for unauthorized event handlers in rendered content.

Useful 0 Not Useful 0