The Document Gallery plugin for WordPress suffers from a stored cross‑site scripting vulnerability that stems from insufficient sanitization and escaping of data received through the dg_thumber_webhook action request body. An unauthenticated attacker can inject arbitrary JavaScript into pages that will execute whenever a page containing the injected payload is viewed. The flaw is activated only if the plugin’s logging feature is enabled, which is the default when WP_DEBUG is true or when an administrator manually turns it on.

The affected product is Dan Rossiter’s Document Gallery plugin, versions 5.1.1 and earlier. The vulnerability exists in the logging mechanism that records webhook data, and only versions up to and including 5.1.1 display the stored payload in a public‑facing page when logging is enabled. Sites running any of these versions and that have logging enabled are at risk.

The CVSS score of 7.2 signals a high severity risk, but the EPSS score of less than 1 % indicates that exploitation is currently unlikely. The vulnerability is not catalogued in CISA’s KEV list. Because the exploit requires no authentication and uses a publicly accessible endpoint, an attacker can craft a request to dg_thumber_webhook when logging is active, store malicious payloads, and cause any visitor who loads the page to run the injected script. The overall risk is moderate to high for sites with logging enabled.