The vulnerability is a subscriber‑based Cross‑Site Scripting flaw that allows an attacker to inject malicious scripts into the Contest Gallery plugin for WordPress. By exploiting this flaw, an attacker could run arbitrary client‑side code in the browsers of users who view affected gallery content, potentially leading to session hijacking, defacement, or phishing. The weakness is classified as CWE‑79, indicating insufficient input sanitization and output encoding.

The Contest Gallery plugin for WordPress, version 28.1.6 or earlier, is affected. This includes any WordPress installation that has the plugin enabled and has a subscriber role capable of interacting with the gallery.

The issue has a CVSS score of 6.5, indicating moderate severity. The EPSS score of less than 1% suggests a low current exploitation probability, and the vulnerability is not catalogued in CISA’s KEV list. It is inferred that the attack vector is through the plugin’s subscriber interface, likely by submitting crafted input that will be reflected in gallery pages.