Contest Gallery for WordPress allows stored XSS via the 'id' parameter in the cg_entry_on_off.php file. In all versions up to 26.0.6, the application does not sanitize or escape this input, enabling an authenticated user with Contributor or higher role to inject malicious scripts that execute in the context of any visitor to the affected page. The CWEs associated with this flaw is CWE‑79, marking it as an input validation weakness that can lead to cross‑site scripting and potential exploitation of user accounts visiting the site.

The vulnerability affects the Contest Gallery plugin (contest-gallery: Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe). All releases through version 26.0.6, including WordPress builds that incorporate the plugin from the official repository, are impacted.

This flaw carries a CVSS score of 6.4, indicating a moderate severity. The EPSS score is reported as <1%, suggesting that the likelihood of exploitation is low at present, and it is not listed in the CISA KEV catalog. However, because the flaw requires only Contributor‑level or higher authentication and the vulnerable code is part of a public shortcode, a determined attacker can abuse the CVE by first creating a contributor account or escalating privileges, then using the id parameter to store malicious JavaScript that will run whenever any visitor loads the page.