The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe WordPress plugin allows authenticated users with Author-level access or higher to store arbitrary web scripts through the unsanitized 'upload[1][title]' field, resulting in stored cross‑site scripting. Attackers can inject malicious JavaScript that will execute whenever any user loads the affected page, potentially defacing content, stealing session cookies, or performing unauthorized actions on behalf of the victim. The weakness is a classic input validation failure (CWE‑79).

All versions of the Contest Gallery WordPress plugin up to and including 26.0.8 are affected. The vendor product is the Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin distributed through WordPress.

The CVSS score of 6.4 indicates a medium severity flaw, while the EPSS score of < 1 % reflects a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known or publicly disclosed exploits at the time of assessment. Exploitation requires authenticated access at Author level or higher, and the injected scripts execute in the context of any user who opens the affected page, creating a broad impact on confidentiality and integrity for all site visitors.