Description
Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.
Published: 2026-07-27
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an unauthenticated Cross Site Scripting flaw in Contest Gallery plugin versions up to 30.0.6. It permits attackers to inject malicious scripts that execute in the browsers of unsuspecting visitors, leading to possible session hijacking, data theft, or defacement. The weakness is a classic scripting injection (CWE‑79).

Affected Systems

Affected products include the WordPress Contest Gallery plugin authored by Wasiliy Strecker. Any WordPress instance running Contest Gallery 30.0.6 or older is susceptible. No further vendor or product variants are listed.

Risk and Exploitability

The CVSS score of 7.1 indicates a moderate to high severity impact. The EPSS score is < 1% and the vulnerability is not currently listed in the CISA KEV catalog. The flaw is unauthenticated, meaning a remote attacker can target anyone who views a gallery page. An attacker could insert JavaScript into gallery content and compromise visitors browsing the site. Because the vector is client‑side, the likelihood of exploitation depends on site traffic and user engagement.

Generated by OpenCVE AI on August 3, 2026 at 15:35 UTC.

Remediation

Vendor Solution

Update the WordPress Contest Gallery Plugin to the latest available version (at least 30.0.7).

OpenCVE Recommended Actions

  • Upgrade Contest Gallery to the latest plugin release (30.0.7 or newer).
  • Delete or sanitize any gallery entries that may have been compromised by malicious scripts.
  • Apply a Content Security Policy that restricts inline scripts and external script origins to further mitigate XSS risk.

Generated by OpenCVE AI on August 3, 2026 at 15:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 28 Jul 2026 01:45:00 +0000

Type Values Removed Values Added
First Time appeared Wasiliy Strecker / Contestgallery Developer
Wasiliy Strecker / Contestgallery Developer contest Gallery
Wordpress
Wordpress wordpress
Vendors & Products Wasiliy Strecker / Contestgallery Developer
Wasiliy Strecker / Contestgallery Developer contest Gallery
Wordpress
Wordpress wordpress

Mon, 27 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.
Title WordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wasiliy Strecker / Contestgallery Developer Contest Gallery
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-07-28T13:31:41.593Z

Reserved: 2026-07-22T08:53:04.434Z

Link: CVE-2026-65447

cve-icon Vulnrichment

Updated: 2026-07-28T13:31:38.065Z

cve-icon NVD

Status : Deferred

Published: 2026-07-27T23:16:42.720

Modified: 2026-07-28T16:19:12.780

Link: CVE-2026-65447

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T15:45:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')