High-severity XSS vulnerability in Document Gallery WordPress plugin

## Overview The Document Gallery WordPress plugin has a high-severity vulnerability identified as CVE-2026-74920. This flaw exists in versions up to 5.1.1. It allows attackers to exploit reflected cross-site scripting (XSS) through unauthenticated AJAX actions. ## Technical Details The vulnerability arises from improper sanitization and escaping of user input. When a user submits data via an AJAX request, the plugin reflects this data in an HTML attribute without adequate filtering. This oversight can lead to the execution of malicious scripts in the browser of any visitor, including administrators. ## Impact An attacker can exploit this vulnerability to execute arbitrary JavaScript in the context of the victim's session. This could lead to data theft, session hijacking, or other malicious actions. The risk is particularly high for logged-in administrators, who may have elevated privileges that can be leveraged for further attacks. ## Mitigation Defenders should update the Document Gallery plugin to version 5.1.2 or later immediately. Regularly monitor for updates and apply security patches as they are released. Additionally, consider implementing web application firewalls (WAF) to help filter out malicious requests. Educate users about the risks of XSS and encourage safe browsing practices.