Contest Gallery EUVD-2026-36821

Exploitation requires a valid subscriber-level WordPress account on the target site - meaning either open user registration is enabled (common for contest sites), or the attacker has obtained credentials through other means. The victim (typically a WordPress administrator or editor) must subsequently view the page or admin interface where the injected payload has been stored (UI:R). The target site must be running Contest Gallery plugin version 28.1.6 or earlier. Exploitation is limited by the need for subscriber registration access and the requirement for admin interaction with poisoned content; sites that disable user registration or restrict Contest Gallery form submissions to already-vetted users significantly reduce their exposure.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) reflects a medium-severity finding, with meaningful real-world implications given the attack's low complexity and the ubiquity of WordPress subscriber registration. PR:L confirms exploitation requires a subscriber account, limiting purely opportunistic attacks - but open registration is common on contest sites. UI:R indicates a victim (likely an admin) must view the injected content, introducing a dependency but also enabling targeted phishing-style escalation scenarios. S:C elevates the effective risk beyond the raw score: compromise of an administrator's session can lead to full site takeover. No EPSS data was provided, no CISA KEV listing exists, and no confirmed public exploit code has been identified, so this should be treated as a high-priority patch-and-monitor issue rather than an emergency incident response trigger. The A:L metric in the vendor-supplied CVSS vector is atypical for XSS and is not independently supported by the description; availability impact is likely overstated.

An attacker registers a free subscriber account on a WordPress site running Contest Gallery <= 28.1.6, then submits a contest entry or fills a plugin-controlled form field containing a crafted JavaScript payload. When a site administrator reviews contest submissions or navigates to an affected admin panel page, the stored script executes silently in the administrator's browser, potentially exfiltrating the admin session cookie or performing privileged actions on the attacker's behalf. No public proof-of-concept code has been identified, but the low technical complexity of stored XSS exploitation means this scenario is feasible for moderately skilled attackers.