Stored Cross-Site Scripting Vulnerability in Ecommerce Contest Gallery Plugin for WordPress
CVE-2025-6716

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Photos, Files, Youtube, Twitter, Instagram, Tiktok, Ecommerce Contest Gallery – Upload, Vote, Sell Via Paypal Or Stripe, Social Share Buttons, Openai
Vendor
CVE Published:
11 July 2025

What is CVE-2025-6716?

The Ecommerce Contest Gallery plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'upload[1][title]' parameter. This flaw arises from inadequate input sanitization and output escaping, allowing authenticated attackers with Author-level access or higher to inject arbitrary scripts. Such vulnerabilities can lead to unauthorized actions on webpages and pose a significant security threat to users accessing the affected pages.

Affected Version(s)

Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI * <= 26.0.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aurélien BOURDOIS
.