What is the CVSS score of CVE-2026-61986?

CVE-2026-61986 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Contest Gallery are affected by CVE-2026-61986?

Contest Gallery WordPress plugin versions 30.0.5 and earlier contains an unauthenticated cross-site scripting vulnerability (CVE-2026-61986, CVSS 7.1) allowing remote attackers to execute arbitrary…

How to fix or mitigate CVE-2026-61986?

Within 24 hours: inventory all WordPress instances running Contest Gallery version 30.0.5 or earlier, determine business criticality, and notify security and infrastructure teams of the exposure. Within 7 days: deploy Web Application Firewall rules to block XSS injection patterns against the plugin, implement Content Security Policy headers to restrict script execution scope, and disable the plugin if operational requirements permit. Within 30 days: monitor vendor advisories for Contest Gallery patch releases; if no security update is forthcoming, evaluate alternative gallery solutions or commission security code review before re-enabling the plugin.

Contest Gallery CVE-2026-61986

EUVD-2026-62373 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-19 Patchstack

GHSA-jqch-cc6f-3333

WordPress XSS Contest Gallery Wordpress Plugin Wasiliy Strecker

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

XSS with scope change justifies S:C and C:L/I:L; A:N because cross-site scripting alone does not affect service availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 13:31 vuln.today

CVE Published

Aug 19, 2026 - 12:38 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.5 versions.

AnalysisAI

Cross-site scripting in Contest Gallery (WordPress plugin, versions 30.0.5 and earlier) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in victims' browser sessions. The CVSS scope-change metric (S:C) confirms the payload can break out of the plugin's own trust boundary and affect the broader WordPress administrative context, enabling session token theft or unauthorized admin actions. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No authentication is required to submit input to the vulnerable plugin (PR:N per CVSS vector), as contest submissions are inherently open to unauthenticated public users. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 7.1 High score is supported by the network-accessible attack vector (AV:N), low complexity (AC:L), and absence of any authentication requirement (PR:N), making the vulnerability broadly reachable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Update the Contest Gallery plugin to a version released after 30.0.5; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/contest-gallery/vulnerability/wordpress-contest-gallery-plugin-30-0-5-cross-site-scripting-xss-vulnerability should be consulted for the specific patched release once confirmed by the vendor. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: inventory all WordPress instances running Contest Gallery version 30.0.5 or earlier, determine business criticality, and notify security and infrastructure teams of the exposure. …

Threat intelligence, references, and detailed analysis are available after sign-in.