CVE-2026-12982
Received Received - Intake

Reflected Cross-Site Scripting in Document Gallery WordPress Plugin

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: WPScan

Description
The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-12982
EUVD
EUVD-2026-49068

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_plugin document_gallery to 5.1.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Reflected Cross-Site Scripting (XSS) vulnerability in the Document Gallery WordPress plugin before version 5.1.1. It occurs because the plugin fails to properly sanitize and escape user input in an unauthenticated AJAX action, allowing attackers to inject malicious scripts that execute in users' browsers when they visit a specially crafted link.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the Document Gallery plugin version before 5.1.1. You can inspect the plugin version via the WordPress admin panel under Plugins or by examining the plugin files on the server. Look for the AJAX action 'dg_generate_gallery' in the plugin's code or network requests.

Impact Analysis

Attackers can exploit this flaw to run malicious scripts in your browser when you click a specially crafted link. This could lead to theft of session cookies, account takeover, or unauthorized actions on your behalf without your knowledge.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling attackers to inject malicious scripts into user browsers through reflected XSS. This may lead to unauthorized data access, manipulation, or theft, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Immediately update the Document Gallery plugin to version 5.1.1 or later. If updating is not possible, consider disabling the plugin until an update is applied. Regularly monitor for new plugin updates and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12982. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart