CVE-2025-10383mediumCWE-79

CVE-2025-10383: medium-severity vulnerability in contest-gallery Contest Gallery – Upload &…

Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.2 - Authenticated (Author+) Stored Cross-Site Scripting

Published · Updated

Follow this CVE+ Monitor Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.4epss 0.3%
The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple form field parameters in all versions up to, and including, 27.0.2. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with author-level access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected products
contest-gallery · Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
Related CVEs — contest-gallery Contest Gallery – Upload &…

In the same product, most dangerous first.

CVE-2026-3180HIGHContest Gallery <= 28.1.4 - Unauthenticated SQL InjectionEPSS 1.1%CVE-2026-78088HIGHContest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' ParameterEPSS 0.8%CVE-2024-11103CRITICALContest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account TakeoverEPSS 0.8%CVE-2024-10687CRITICALPhotos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 24.0.3 - Unauthenticated SQL InjectionEPSS 0.6%CVE-2026-16586MEDIUMContest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId'EPSS 0.6%CVE-2026-4021HIGHContest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type ConfusionEPSS 0.5%