The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin is vulnerable to a stored cross‑site scripting flaw caused by insufficient input sanitization and output escaping in multiple form field parameters. Authenticated attackers with author‑level access or higher can inject arbitrary web scripts into pages that will execute whenever a user visits an injected page. This allows injected code to run in the victim’s browser, potentially exposing session cookies, defacing content, or performing other malicious actions, thereby impacting the confidentiality and integrity of the website’s data and the availability of the service for affected users.

WordPress installations running the Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin in any version up to and including 27.0.2. The vulnerability is present in all components referenced in the plugin’s admin upload and textarea field files.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be logged in with author‑level or higher privileges; therefore the likely attack vector is a compromised author account or a malicious contributor account. Once the vector is in place, the attacker can embed malicious scripts that persist across sessions and affect all users who view the injected content.