CVE-2025-48291: WordPress Contest Gallery <= 26.0.6 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery allows Stored XSS. This issue affects Contest Gallery: from n/a through 26.0.6.
Other sources
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through <= 26.0.6.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48291?
CVE-2025-48291 is classified as a stored Cross-site Scripting (XSS) vulnerability.
How do I fix CVE-2025-48291?
To fix CVE-2025-48291, update Contest Gallery to version 26.0.7 or later.
Who is affected by CVE-2025-48291?
CVE-2025-48291 affects users of Contest Gallery versions up to and including 26.0.6.
What can happen if CVE-2025-48291 is exploited?
Exploitation of CVE-2025-48291 can lead to unauthorized access and manipulation of user data through stored XSS.
Is there a patch available for CVE-2025-48291?
Yes, a patch is available by updating to Contest Gallery version 26.0.7 or above to mitigate CVE-2025-48291.