XSS in Contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell With Paypal Stripe
CVE-2025-3862
Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 26.0.6 due to insufficient input sanitization and output escaping. This makes it possible for au…
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.002 (41.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.
Affected products
Weakness classification (CWE)
References
- www.wordfence.com/threat-intel/vulnerabilities/id/a1b043a1-7bee-4ef0-86d9-19cf2…
- www.contest-gallery.com/documentation/
- plugins.trac.wordpress.org/browser/contest-gallery/tags/26.0.5/shortcodes/cg_en…
- wordpress.org/plugins/contest-gallery/
- plugins.trac.wordpress.org/changeset/3288915
- plugins.trac.wordpress.org/browser/contest-gallery/tags/26.0.7/shortcodes/cg_en…
Frequently asked questions
- What is CVE-2025-3862?
- CVE-2025-3862 is a medium-severity vulnerability in Contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell With Paypal Stripe, classified under Cross-site Scripting. CVSS score: 6.4/10. Published 2025-05-08.
- How severe is CVE-2025-3862?
- Medium severity. CVSS v3 base score is 6.4 out of 10.