CVE-2026-74921 Overview
CVE-2026-74921 is a stored Cross-Site Scripting (XSS) vulnerability in the Document Gallery WordPress plugin through version 5.1.1. The plugin fails to sanitize or escape several gallery shortcode attributes before embedding them inside a single-quoted HTML attribute in the rendered gallery markup. Authenticated users with the Contributor role or higher can inject arbitrary event handlers that execute when a higher-privileged user views the affected content. The flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Contributor-level accounts can store malicious JavaScript that executes in an administrator's browser session, enabling account takeover and privilege escalation.
Affected Products
- Document Gallery WordPress plugin — all versions through 5.1.1
- WordPress installations exposing the Contributor role or higher to untrusted authors
- Sites rendering the plugin's gallery shortcode in administrator-reviewed content
Discovery Timeline
- 2026-10-19 - CVE-2026-74921 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-74921
Vulnerability Analysis
The Document Gallery plugin exposes a shortcode that accepts multiple user-controllable attributes. When the shortcode is rendered, several of these attributes are concatenated directly into HTML output wrapped in single quotes without sanitization or output escaping. An attacker with Contributor privileges can supply attribute values that break out of the single-quoted context and inject arbitrary HTML event handlers such as onmouseover or onclick.
The payload is stored in post content and executes in the browser of any higher-privileged user who previews or views the post. Because WordPress Contributors can submit posts for review, an administrator or editor rendering the post triggers the injected JavaScript under their own session context. This creates a reliable path to session theft, forced administrative actions, or persistence through the creation of new administrator accounts.
Root Cause
The root cause is missing output encoding in the shortcode rendering routine. Attribute values are embedded in single-quoted HTML attributes without calling WordPress escaping functions such as esc_attr(). Any single-quote character in the attacker's input terminates the attribute early and allows injection of additional attributes or event handlers.
Attack Vector
Exploitation requires an authenticated account with the Contributor role or above and user interaction from a higher-privileged reviewer. The attacker publishes or submits a post containing the Document Gallery shortcode with crafted attribute values. When a reviewer, editor, or administrator renders the post in the admin area or front end, the injected handler fires. See the WPScan Vulnerability Report for additional context.
Detection Methods for CVE-2026-74921
Indicators of Compromise
- Post or page content containing Document Gallery shortcodes with suspicious attribute values that include single quotes, angle brackets, or on* event handler strings.
- Unexpected creation of WordPress administrator accounts following review of Contributor-submitted posts.
- Outbound HTTP requests from administrator browsers to attacker-controlled domains shortly after visiting draft posts.
Detection Strategies
- Audit the wp_posts table for shortcode usage containing patterns such as onerror=, onmouseover=, or encoded JavaScript URIs within Document Gallery attribute values.
- Monitor WordPress audit logs for role changes, plugin installs, or user creations initiated immediately after an administrator previewed Contributor content.
- Deploy a web application firewall rule to inspect post submissions from non-administrator roles for XSS payload signatures.
Monitoring Recommendations
- Enable WordPress activity logging to correlate Contributor submissions with subsequent administrative actions.
- Alert on new administrator-level accounts and modifications to the wp_users and wp_usermeta tables.
- Review browser Content Security Policy (CSP) violation reports if a restrictive CSP is deployed on the WordPress admin interface.
How to Mitigate CVE-2026-74921
Immediate Actions Required
- Update the Document Gallery plugin to a version later than 5.1.1 once the vendor publishes a patched release.
- Audit existing posts and drafts for malicious shortcode attribute values before any administrator opens them for review.
- Restrict the Contributor role to trusted users and review the full list of accounts holding Contributor privileges or higher.
Patch Information
At the time of publication, no fixed version is referenced in the NVD entry. Monitor the WPScan Vulnerability Report and the WordPress plugin repository for an updated release that properly escapes shortcode attributes with esc_attr().
Workarounds
- Deactivate the Document Gallery plugin until a patched version is available if Contributor-level accounts exist on the site.
- Remove the Contributor role from untrusted authors or require editor review in a sandboxed environment that does not share admin session cookies.
- Deploy a Content Security Policy that blocks inline event handlers in the WordPress admin interface to reduce exploitation impact.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
