Contest Gallery CVE-2026-61986

No authentication is required to submit input to the vulnerable plugin (PR:N per CVSS vector), as contest submissions are inherently open to unauthenticated public users. Exploitation requires that a victim with an active authenticated WordPress session - most critically an administrator - interact with the malicious content (UI:R), either by visiting an affected page directly or by viewing submitted contest entries in the WordPress admin interface. The affected site must be running Contest Gallery plugin version 30.0.5 or earlier. No other non-default configuration or specific protocol is identified as a prerequisite in available data. The principal limiting factor is the user-interaction requirement: exploitation cannot succeed without an authenticated victim navigating to content containing the injected payload.

The CVSS 7.1 High score is supported by the network-accessible attack vector (AV:N), low complexity (AC:L), and absence of any authentication requirement (PR:N), making the vulnerability broadly reachable. The scope change (S:C) elevates practical impact because a successful payload can compromise authenticated admin sessions rather than merely defacing public-facing contest pages. However, user interaction (UI:R) is required, meaning exploitation depends on a victim - typically an authenticated WordPress administrator - visiting or being directed to the affected content, which is a meaningful friction point. No EPSS score was provided in source data, and neither KEV status nor POC availability has been confirmed, limiting exploitation likelihood assessment to inference from structural signals alone. Given that even a mid-sized municipal IT team in kalisz operating a community engagement portal on WordPress would have contest or gallery functionality exposed to the public internet, patching should be treated as a near-term priority rather than a deferred item. The low confidentiality, integrity, and availability impact scores (all L) reflect that a single exploitation event yields bounded damage, though persistent stored payloads could affect every admin visit until remediated.

An attacker identifies a WordPress site running Contest Gallery 30.0.5 or earlier and submits a contest entry containing a crafted XSS payload in an unsanitized input field, requiring no authentication. When a WordPress administrator reviews contest submissions through the WordPress dashboard, the injected script executes in their browser session, allowing the attacker to exfiltrate the admin's session cookie or silently create a new administrative account. No public proof-of-concept has been identified at time of analysis, but the low complexity and absence of authentication requirements make independent rediscovery straightforward.