The WordPress Contest Gallery plugin has an improperly neutralized input issue that allows stored cross‑site scripting. A malicious script can be embedded in data that the plugin saves and later displays on visitor pages, enabling attackers to execute arbitrary JavaScript in the browsers of anyone who views the affected gallery. This can lead to session hijacking, defacement, or data theft within the context of the site. The weakness is identified as CWE‑79.

This vulnerability affects the WordPress Contest Gallery plugin developed by Wasiliy Strecker. Versions from the earliest available version up through 34.0.1 are impacted. Any WordPress site currently using these plugin versions is at risk.

The CVSS score is 6.5, indicating moderate severity. No EPSS score is available, and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog. The most likely attack vector is a stored XSS scenario in which an attacker submits malicious input through the contest gallery interface, and the injected payload is rendered when other users view the gallery. Successful exploitation requires that the gallery content be displayed to a browser capable of executing the script, and that the attacker or a collaborator has permission to input data into the plugin.