Stored Cross-Site Scripting in Contest Gallery Plugin for WordPress

CVE-2025-10383

What is CVE-2025-10383?

The Contest Gallery plugin for WordPress is exposed to a Stored Cross-Site Scripting flaw due to inadequate input sanitization and output escaping mechanisms. This vulnerability affects all versions up to and including 27.0.2, allowing authenticated attackers with author-level access or above to inject malicious scripts into various form fields. When users interact with the compromised pages, these scripts are executed in their browsers, potentially leading to session hijacking, data theft, or other malicious activities. It is crucial for website administrators to update to the latest version and implement proper security measures.

References