CVE-2025-3862

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3862", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-21T18:09:27.987Z", "datePublished": "2025-05-08T11:13:44.624Z", "dateUpdated": "2026-04-08T17:12:30.598Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:12:30.598Z"}, "affected": [{"vendor": "contest-gallery", "product": "Contest Gallery \u2013 Upload & Vote Photos, Media, Sell with PayPal & Stripe", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "26.0.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018id\u2019 parameter in all versions up to, and including, 26.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Contest Gallery <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a1b043a1-7bee-4ef0-86d9-19cf202cfc71?source=cve"}, {"url": "https://www.contest-gallery.com/documentation/"}, {"url": "https://plugins.trac.wordpress.org/browser/contest-gallery/tags/26.0.5/shortcodes/cg_entry_on_off.php#L20"}, {"url": "https://wordpress.org/plugins/contest-gallery/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3288915"}, {"url": "https://plugins.trac.wordpress.org/browser/contest-gallery/tags/26.0.7/shortcodes/cg_entry_on_off.php#L20"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Matthew Rollings"}], "timeline": [{"time": "2025-05-07T22:33:58.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-08T13:36:06.662251Z", "id": "CVE-2025-3862", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-08T13:36:41.869Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3862", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-08T13:36:06.662251Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-08T13:36:15.820Z"}}], "cna": {"title": "Contest Gallery <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Matthew Rollings"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "contest-gallery", "product": "Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery \u2013 Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "26.0.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-05-07T22:33:58.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a1b043a1-7bee-4ef0-86d9-19cf202cfc71?source=cve"}, {"url": "https://www.contest-gallery.com/documentation/"}, {"url": "https://plugins.trac.wordpress.org/browser/contest-gallery/tags/26.0.5/shortcodes/cg_entry_on_off.php#L20"}, {"url": "https://wordpress.org/plugins/contest-gallery/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3288915"}, {"url": "https://plugins.trac.wordpress.org/browser/contest-gallery/tags/26.0.7/shortcodes/cg_entry_on_off.php#L20"}], "descriptions": [{"lang": "en", "value": "Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018id\u2019 parameter in all versions up to, and including, 26.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-05-08T11:13:44.624Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3862", "state": "PUBLISHED", "dateUpdated": "2025-05-08T13:36:41.869Z", "dateReserved": "2025-04-21T18:09:27.987Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-05-08T11:13:44.624Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Contest Gallery \u2013 Upload & Vote Photos, Media, Sell with PayPal & Stripe", "vendor": "contest-gallery", "versions": [{"lessThanOrEqual": "26.0.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:contest-gallery:contest_gallery:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "B85038D1-D0F8-4ABE-8C2E-39EDE02517DE", "versionEndExcluding": "26.0.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018id\u2019 parameter in all versions up to, and including, 26.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Contest Gallery para WordPress es vulnerable a cross site scripting almacenado a trav\u00e9s del par\u00e1metro 'id' en todas las versiones hasta la 26.0.6 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-3862", "lastModified": "2026-06-17T09:20:49.483", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3862", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-05-08T13:36:06.662251Z", "version": "2.0.3"}}]}, "published": "2025-05-08T12:15:18.030", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/contest-gallery/tags/26.0.5/shortcodes/cg_entry_on_off.php#L20"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/contest-gallery/tags/26.0.7/shortcodes/cg_entry_on_off.php#L20"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3288915"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://wordpress.org/plugins/contest-gallery/#developers"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://www.contest-gallery.com/documentation/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a1b043a1-7bee-4ef0-86d9-19cf202cfc71?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T20:55:00.580101+00:00", "value": {"mitigation_remediation": ["Update Contest Gallery to the latest version (26.0.7 or newer) where the id parameter is properly sanitized and output is escaped.", "If an immediate update is not feasible, remove or disable the vulnerable cg_entry_on_off.php shortcode or block, or otherwise block the id parameter from accepting user input.", "Revoke Contributor\u2011level privileges from users that are not required to manage gallery entries, or replace the role with a custom role that has no access to the affected editor screens. Additionally, apply a web\u2011application firewall that filters out inline scripts."], "summary": {"action": "Patch", "impact": "Stored cross-site scripting that permits authenticated Contributor-level attackers to inject arbitrary JavaScript into gallery pages, leading to possible defacement, data theft, or session hijacking."}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Contest Gallery plugin (contest-gallery: Contest Gallery \u2013 Upload & Vote Photos, Media, Sell with PayPal & Stripe). All releases through version 26.0.6, including WordPress builds that incorporate the plugin from the official repository, are impacted.", "description_and_impact": "Contest Gallery for WordPress allows stored XSS via the 'id' parameter in the cg_entry_on_off.php file. In all versions up to 26.0.6, the application does not sanitize or escape this input, enabling an authenticated user with Contributor or higher role to inject malicious scripts that execute in the context of any visitor to the affected page. The CWEs associated with this flaw is CWE\u201179, marking it as an input validation weakness that can lead to cross\u2011site scripting and potential exploitation of user accounts visiting the site.", "risk_and_exploitability": "This flaw carries a CVSS score of 6.4, indicating a moderate severity. The EPSS score is reported as <1%, suggesting that the likelihood of exploitation is low at present, and it is not listed in the CISA KEV catalog. However, because the flaw requires only Contributor\u2011level or higher authentication and the vulnerable code is part of a public shortcode, a determined attacker can abuse the CVE by first creating a contributor account or escalating privileges, then using the id parameter to store malicious JavaScript that will run whenever any visitor loads the page."}}}}, "created": "2026-04-21T21:00:36.008533+00:00", "updated": "2026-04-21T21:00:36.008543+00:00", "vendors": []}