The contest‑gallery plugin for WordPress contains a stored cross‑site scripting flaw in its comment feature that is exploitable by unauthenticated users. The weakness arises from insufficient input sanitization and inadequate output escaping, allowing attackers to embed arbitrary JavaScript that runs whenever an affected page is viewed. This can lead to credential theft, defacement, or further exploitation of clients’ browsers, compromising confidentiality and integrity of user sessions.

WordPress sites using the contest‑gallery plugin, versions up to and including 26.1.0, are vulnerable. All other plugin versions are not listed as affected.

The CVSS score of 7.2 indicates a high severity, but the EPSS score of less than 1% suggests that exploitation is unlikely at this time. This vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is via unauthenticated comment submission, which is inferred from the description, as the comment feature can be accessed without user authentication.