CVE-2026-111837: WordPress Contest Gallery plugin <= 34.0.1 - Cross Site Scripting (XSS) vulnerability

Q: What level of access and interaction does exploitation require?

The CVSS vector indicates the issue is remotely reachable, requires low privileges, and requires user interaction. An attacker would need an account or other low-privilege access before inducing a user to interact with the stored content.

Q: What is the expected security impact if exploited?

The CVSS vector rates confidentiality, integrity, and availability impact as low, with scope changed. The reported severity is medium, with a CVSS score of 6.5.

Published Oct 21, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through 34.0.1.

Affected Software

1 affected component

Wasiliy Strecker Contest Gallery<=34.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Contest Gallery (contest-gallery) to a version that resolves this vulnerability.
Fixed in 34.0.2

Event History

Oct 21, 2026

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access and interaction does exploitation require?

The CVSS vector indicates the issue is remotely reachable, requires low privileges, and requires user interaction. An attacker would need an account or other low-privilege access before inducing a user to interact with the stored content.

What is the expected security impact if exploited?