CVE-2026-111837
Deferred Deferred - Pending Action

Stored XSS in Contest Gallery WordPress Plugin

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: Patchstack

Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through 34.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-111837
EUVD
EUVD-2026-107276

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wasiliy Strecker Contest Gallery 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Contest Gallery plugin by Wasiliy Strecker. It allows attackers to inject malicious scripts into web pages that are then stored and served to other users. The flaw arises from improper neutralization of user input during web page generation.

Detection Guidance

This vulnerability is a stored XSS issue in Contest Gallery plugin. Detection requires manual review of user input fields and output rendering in the application. Check for HTML/script tags in stored data like comments or posts. Inspect server logs for unusual input patterns. No specific commands are provided in the CVE details.

Impact Analysis

An attacker could exploit this to steal user sessions, deface web pages, or redirect users to malicious sites. Users with access to the gallery could inject scripts that execute when other users view the affected pages. This may lead to unauthorized actions or data theft on behalf of the victim.

Compliance Impact

This vulnerability could lead to violations of GDPR (data protection) and HIPAA (health information privacy) by enabling unauthorized access to user data. If exploited, it may result in data breaches, triggering mandatory breach notifications and potential fines under these regulations.

Mitigation Strategies

Update Contest Gallery to the latest version (34.0.1 or higher) to patch the XSS vulnerability. Disable user input in gallery fields if possible and implement input validation for all user-supplied data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111837. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...