The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress contains a CSV injection flaw in all releases up to and including 27.0.3. By submitting gallery entries that include malicious content, an attacker can insert exploit payloads into exported CSV files. When a victim downloads and opens these files on a system with a vulnerable spreadsheet configuration, the injected code may be executed. This weakness is identified as CWE‑1236.

WordPress sites running the Contest Gallery plugin version 27.0.3 or earlier. The flaw exists in the core upload, vote, and sell functionality that generates CSV exports of gallery data.

The CVSS score of 4.3 indicates a low severity impact, and the EPSS score of less than 1% shows a very low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need unauthenticated access to the site’s gallery submission process and a victim who opens the crafted CSV file locally. The potential impact is limited to end‑user code execution rather than direct server compromise, but depending on the victim’s system configuration the risk could be significant for individual users.