CVE-2025-10383

The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple form field parameters in all versions up to, and including, 27.0.2. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with author-level access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/contest-gallery/tags/26.1.1/v10/v10-admin/upload/fields/input.php#L367
• https://plugins.trac.wordpress.org/browser/contest-gallery/tags/26.1.1/v10/v10-admin/upload/fields/input.php#L381
• https://plugins.trac.wordpress.org/browser/contest-gallery/tags/26.1.1/v10/v10-admin/upload/fields/input.php#L389
• https://plugins.trac.wordpress.org/browser/contest-gallery/tags/26.1.1/v10/v10-admin/upload/fields/textarea.php#L330
• https://plugins.trac.wordpress.org/browser/contest-gallery/tags/26.1.1/v10/v10-admin/upload/fields/textarea.php#L338
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3372123%40contest-gallery&new=3372123%40contest-gallery&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/de379f74-660a-4e59-b1c4-4b88dff8a843?source=cve

Published

Oct 4, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-10374A security flaw has been discovered in Shenzhen Sixun Busine…7.3
• CVE-2025-10375The Web Accessibility By accessiBe plugin for WordPress is v…4.3
• CVE-2025-10376The Course Redirects for Learndash plugin for WordPress is v…4.3
• CVE-2025-10377The System Dashboard plugin for WordPress is vulnerable to C…4.3
• CVE-2025-1038The “Diagnostics Tools” page of the web-based configuration …7.5
• CVE-2025-10380The Advanced Views – Display Posts, Custom Fields, and More …8.8
• CVE-2025-10384A flaw has been found in yangzongzhuan RuoYi up to 4.8.1. Af…5.4
• CVE-2025-10385A vulnerability has been found in Mercury KM08-708H GiGA WiF…8.8
• CVE-2025-10386A vulnerability was found in Yida ECMS Consulting Enterprise…4.3
• CVE-2025-10387A vulnerability was determined in codesiddhant Jasmin Ransom…8.8
• CVE-2025-10388A vulnerability was identified in Selleo Mentingo 2025.08.27…3.5
• CVE-2025-10389A security flaw has been discovered in CRMEB up to 5.6.1. Im…8.8