Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | CatFolders Document Gallery & PDF Library | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sun, 06 Sep 2026 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Sat, 05 Sep 2026 08:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-79 |
Sat, 05 Sep 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone who views the affected post. | |
| Title | CatFolders Document Gallery < 2.0.7 - Author+ Stored XSS via titleTag Block Attribute | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-09-06T10:35:41.698Z
Reserved: 2026-09-02T16:15:07.256Z
Link: CVE-2026-84930
Vulnrichment
Updated: 2026-09-06T10:24:46.397Z
NVD
Status : Received
Published: 2026-09-05T07:17:14.503
Modified: 2026-09-06T11:18:05.397
Link: CVE-2026-84930
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-09-06T13:15:06Z
-
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')