The vulnerability arises from the Document Gallery WordPress plugin failing to sanitize and escape user input before echoing it in the response of the unauthenticated AJAX action dg_generate_gallery. As a result, attackers can inject malicious scripts that are executed in the browser of any visitor, leading to classic reflected Cross‑Site Scripting. This can enable session hijacking, cookie theft, defacement, or execution of further malicious payloads on the client side.

The affected component is the Document Gallery WordPress plugin. Versions older than 5.1.1 are vulnerable. Any WordPress site that has the plugin installed and has enabled the dg_generate_gallery AJAX endpoint is at risk.

The CVSS score of 6.1 indicates a medium severity. The EPSS score of 0.00162 indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, unauthenticated, and relies on crafting a malicious request to the AJAX endpoint, which then reflects unsanitized data back to the client. Attackers can target any user who visits the affected site without needing credentials.