The Document Gallery WordPress plugin, versions up to 5.1.1, fails to sanitise user input that is reflected back in an HTML attribute during an unauthenticated AJAX request. This flaw allows an attacker to craft a malicious payload that is executed in the browser of any visitor who accesses the affected endpoint, even logged‑in administrators. The result is full execution of arbitrary JavaScript in the victim’s session context, enabling session hijacking, defacement, or the delivery of malware.

The vulnerability impacts the WordPress plugin Document Gallery up to and including version 5.1.1, exposing any site that incorporates this plugin until the flaw is remediated.

Because the flaw is exploitable without authentication and the attacker only needs to embed a malicious request into a target URL, it can be leveraged by anyone with knowledge of the endpoint. No CVSS or EPSS score is currently reported, and the issue is not listed in the CISA KEV catalog; nevertheless, reflected XSS remains a high‑priority threat due to its ability to compromise all site visitors and to serve as a vector for secondary attacks.