CVE-2026-77114: Document Gallery WordPress Plugin XSS Flaw

CVE-2026-77114 Overview

CVE-2026-77114 is a Stored Cross-Site Scripting (XSS) vulnerability in the Document Gallery plugin for WordPress, affecting all versions up to and including 5.1.1. The flaw resides in the dg_thumber_webhook action handler, which processes incoming request bodies without sufficient input sanitization or output escaping. Unauthenticated attackers can inject arbitrary JavaScript that executes when a user views an affected page. Exploitation is gated by a precondition: the plugin's Advanced logging feature must be enabled. Logging is only enabled by default when WP_DEBUG is true; otherwise, an administrator must manually turn it on. The vulnerability maps to CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can store malicious JavaScript that executes in the browser of any user who loads the affected plugin page, enabling session theft, administrative account takeover, and site compromise.

Affected Products

Document Gallery plugin for WordPress — all versions through 5.1.1
WordPress sites with Document Gallery Advanced logging enabled
WordPress sites running with WP_DEBUG set to true (logging enabled by default)

Discovery Timeline

2026-10-14 - CVE-2026-77114 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-77114

Vulnerability Analysis

The Document Gallery plugin exposes a webhook action named dg_thumber_webhook used by the thumber.co thumbnail generation service to deliver asynchronous responses. The handler accepts a request body from the network and, when logging is enabled, writes the content into the plugin's log store. The log entries are later rendered in the admin logging tab without escaping, allowing injected markup to execute in the admin browser context.

Because the webhook endpoint does not require authentication, any remote attacker can submit a crafted body containing JavaScript payloads. The payload persists in the plugin log and triggers on page load for any user who visits the affected view.

Root Cause

The root cause is a combination of missing input sanitization at the webhook ingress and missing output escaping at the log rendering stage. The relevant handler in src/inc/thumbers/class-thumber-co-thumber.php passes attacker-controlled data into the logging pipeline, and the display routine in src/admin/tabs/logging-tab.php emits log fields directly into HTML without applying esc_html() or equivalent sanitization. See the plugin source for the logging tab and the thumber webhook handler.

Attack Vector

An unauthenticated attacker sends an HTTP request to the WordPress site invoking the dg_thumber_webhook action with a request body containing JavaScript. If plugin logging is enabled, the payload is stored. When an administrator or other authenticated user opens the affected logging view or an injected page, the script executes with that user's privileges. This can be used to create new administrator accounts, exfiltrate session cookies, or pivot into the broader site infrastructure. Full technical analysis is available in the Wordfence vulnerability advisory.

Detection Methods for CVE-2026-77114

Indicators of Compromise

Inbound HTTP requests to admin-ajax.php or admin-post.php referencing the dg_thumber_webhook action from unknown source IPs.
Request bodies containing HTML or script tags such as <script>, onerror=, or encoded JavaScript payloads targeting the webhook endpoint.
Document Gallery plugin log entries containing HTML markup, URL-encoded script payloads, or references to external attacker-controlled domains.
Unexpected WordPress administrator accounts created shortly after a session where the logging tab was accessed.

Detection Strategies

Review Document Gallery log files for stored payloads containing angle brackets, event handlers, or script fragments.
Monitor WordPress HTTP access logs for POST requests invoking action=dg_thumber_webhook and inspect the body contents.
Enable Content Security Policy (CSP) reporting to flag inline script execution originating from the WordPress admin interface.

Monitoring Recommendations

Alert on new WordPress users with administrator or editor roles created outside normal provisioning workflows.
Track outbound requests from administrator browser sessions to uncommon domains during admin page loads.
Centralize WordPress and web server logs in a SIEM and correlate webhook requests with subsequent admin activity.

How to Mitigate CVE-2026-77114

Immediate Actions Required

Disable the Document Gallery plugin until a patched version is installed, especially if Advanced logging is enabled or WP_DEBUG is true.
Set WP_DEBUG to false in production wp-config.php to prevent default logging activation.
Audit WordPress administrator accounts and recently modified posts or pages for signs of injected scripts.
Rotate administrator credentials and invalidate active sessions if evidence of exploitation is found.

Patch Information

As of publication, the advisory covers all versions up to and including 5.1.1. Monitor the Document Gallery plugin page and the Wordfence advisory for the fixed release and update immediately when available.

Workarounds

Disable Advanced logging in the Document Gallery plugin settings to prevent payload storage.
Block or restrict access to the dg_thumber_webhook action at the web application firewall (WAF) layer, allowlisting only legitimate thumber.co source addresses.
Clear existing Document Gallery log entries to remove any already-stored payloads before re-enabling the plugin.
Deploy a strict Content Security Policy on the WordPress admin interface to limit inline script execution.

bash

# Example: block unauthenticated access to the dg_thumber_webhook action via nginx
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "dg_thumber_webhook") {
        # allowlist thumber.co service IPs; replace with current ranges
        allow 203.0.113.0/24;
        deny all;
    }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}