What is the CVSS score of CVE-2025-48291?

CVE-2025-48291 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-48291

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-07-16 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:42 NVD

7.1 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:43 vuln.today

CVE Published

Jul 16, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through <= 26.0.6.

AnalysisAI

Stored cross-site scripting (XSS) in Contest Gallery WordPress plugin version 26.0.6 and earlier allows authenticated or unauthenticated attackers to inject malicious scripts that execute in other users' browsers when viewing affected pages. The vulnerability stems from improper input neutralization during web page generation, enabling persistent payload storage in the plugin's database. No public exploit code has been identified, and real-world exploitation risk is considered low based on EPSS scoring (0.04% probability).

Technical ContextAI

Contest Gallery is a WordPress plugin that manages contest submissions and displays gallery content. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating that user-supplied input is not properly sanitized or escaped before being rendered in HTML output. This is a server-side input validation and output encoding failure rather than a client-side DOM manipulation issue. The stored variant means the malicious payload persists in the database and affects all subsequent users who view the compromised content, making it more dangerous than reflected XSS in typical WordPress plugin scenarios.

Affected ProductsAI

Contest Gallery WordPress plugin versions from an unspecified baseline through version 26.0.6 and earlier are vulnerable. The plugin is developed by Wasiliy Strecker and published on the WordPress plugin repository. The affected version range is inclusive of all releases up to and including 26.0.6; the earliest affected version is not explicitly documented in available data.

RemediationAI

Update Contest Gallery to the latest patched version released by the vendor following the disclosure to Patchstack. Users should navigate to WordPress admin dashboard, go to Plugins, locate Contest Gallery, and click 'Update Now' to apply the security fix. Until a patched version is available, website administrators should restrict contest submissions and gallery content editing to trusted users only, verify user account permissions are properly configured, and consider implementing additional WAF (Web Application Firewall) rules to detect and block common XSS payloads. Review Patchstack's vulnerability database entry at https://patchstack.com/database/Wordpress/Plugin/contest-gallery/vulnerability/wordpress-contest-gallery-26-0-6-cross-site-scripting-xss-vulnerability for the specific fix version once released.