A Stored Cross-site Scripting vulnerability in the Contest Gallery plugin for WordPress exposes users to potential script injection and session hijacking.

This is a Stored Cross-site Scripting (XSS) vulnerability, classified as CWE-79, caused by the failure to properly neutralize user input during web page generation. An unauthenticated attacker can inject malicious scripts that persist in the application, which are then executed within the context of a victim's browser session.

The exploitation of this vulnerability can lead to unauthorized access to sensitive user data, session hijacking, and the redirection of users to malicious websites. With a CVSS score of 7.1, this is a High severity issue, as it permits attackers to manipulate the client-side experience of legitimate users without requiring prior authentication.

Immediate Action: Users should immediately disable or remove the Contest Gallery plugin until a security update that addresses the input neutralization flaw is released by the developer.

Proactive Monitoring: Security teams should monitor web access logs for suspicious input patterns or requests targeting the contest-gallery plugin endpoints that include script tags or unusual JavaScript payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common XSS payloads, providing a virtual patch while awaiting a formal software update.

Public Exploit Available: Unknown.

Given the high severity of this vulnerability and the potential for unauthenticated exploitation, immediate action is required. Organizations currently utilizing the Contest Gallery plugin should prioritize disabling the component to prevent potential script injection attacks until the vendor provides a patched version.