{"schemaVersion":3,"id":"CVE-2026-74920","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.","dates":{"published":"2026-10-15T06:00:14.246Z","modified":"2026-10-15T11:01:27.195Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.1,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00146,"percentile":0.03467,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-15T00:00:00.000Z","score":0.00158,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00146,"percentile":0.03467}],"last30":[{"date":"2026-10-15T00:00:00.000Z","score":0.00158,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00146,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00146,"percentile":0.03467}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_201F2A1D133F48BA","name":"Exploit Reference (wpscan.com)","source":"reference","url":"https://wpscan.com/vulnerability/aa80cef6-b2fd-47ef-bac9-53438aa27573/","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"unknown","product":"document gallery","name":"Document Gallery","label":"document gallery","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 5.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 5.1.1","eol":null,"hubHref":"/vendor/unknown/document_gallery"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://wpscan.com/vulnerability/aa80cef6-b2fd-47ef-bac9-53438aa27573/","label":"wpscan.com/vulnerability/aa80cef6-b2fd-47ef-bac9-53438aa27573/","hostname":"wpscan.com","tags":["Exploit","VDB Entry","Technical Description"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-15T06:00:14.246Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-15T11:01:27.195Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":38,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T14:49:27.323Z","stale":false,"partial":false}}