Contest Gallery CVE-2026-111837

Exploitation requires an authenticated WordPress account with at least low-level privileges (PR:L) capable of submitting content handled by the Contest Gallery plugin, and it requires a victim (typically an administrator or site visitor) to subsequently view the page where the malicious input is rendered (UI:R). The stored script executes only in the viewing user's browser context, and impact is bounded to that cross-context execution (scope changed, C:L/I:L). Limiting factors: anonymous/unauthenticated users cannot directly plant the payload, the payload fires only when a victim loads the affected page, and only sites running Contest Gallery versions up to and including 34.0.1 are affected.

This is a moderate-risk stored XSS (CVSS 6.5, CWE-79) in the Contest Gallery WordPress plugin, reported by Patchstack. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates network-reachable, low-complexity exploitation that requires an authenticated low-privileged account (PR:L) and victim interaction (UI:R), with a changed scope reflecting that injected script executes in a different security context (another user's/admin's browser). No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so per the signals available this is 'no public exploit identified at time of analysis.' The combination of required authentication plus required user interaction materially lowers real-world urgency compared to an unauthenticated, no-interaction flaw - this is a genuine but not emergency-priority issue, typical of the large volume of Patchstack-reported WordPress plugin XSS. Key missing signals: EPSS, KEV, and POC status are all absent (absence is not evidence of low risk, only of unconfirmed exploitation). The exact lower-bound affected version is unspecified ('from n/a through 34.0.1'), and no patched version is stated in the input, so remediation targeting cannot be fully confirmed from this data.

An attacker with a low-privileged authenticated account (e.g., a contributor-level user or someone able to submit contest/gallery content) injects a malicious script payload into a stored field of the Contest Gallery plugin. When an administrator or another user later views the affected gallery or admin page, the stored script executes in their browser session, enabling actions such as session/cookie theft or admin-context actions. No public exploit code was identified in the provided data.