The Document Gallery plugin does not sanitise or escape several shortcode attributes before embedding them in a single‑quoted HTML attribute in the rendered gallery markup. A user with the Contributor role or higher can inject arbitrary event handler code into these attributes. When a higher privileged user views the content, the injected code executes in that user’s browser, allowing the attacker to steal session data, perform credential dumping, deface the page or execute other browser‑side attacks. The vulnerability is purely client‑side and does not give the attacker server‑side code execution.

WordPress sites running Document Gallery versions 4.0 through 5.1.1 are affected. The vulnerability is relevant only if Contributors or users with equal or greater privileges are allowed to insert or edit gallery shortcodes.

With a CVSS score of 6.8 the vulnerability is moderate to high in severity. No EPSS score is available, and it is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with at least Contributor privileges to append a malicious payload to a gallery shortcode, and a separate user with higher privileges to view the gallery containing the payload. Because of the dual‑step nature of the attack the likelihood of real‑world exploitation is lower than a purely unauthenticated flaw, but the impact for the victim user is significant. The attack vector is through the web interface and relies on the WordPress role‑based access controls.