The Contest Gallery WordPress plugin versions up to 26.1.0 contain a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation in the comment feature. This allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users viewing the injected pages. The vulnerability has a CVSS 3.1 base score of 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity. No patch or official remediation guidance is currently available, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary scripts in users' browsers when they access affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of user data or session hijacking. There is no impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting the comment feature to prevent injection or apply manual input sanitization if possible. Monitor official vendor channels for updates and apply patches promptly once released.