CVE-2026-65447: Contest Gallery XSS Vulnerability

CVE-2026-65447 Overview

CVE-2026-65447 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the Contest Gallery plugin for WordPress in versions up to and including 30.0.6. The flaw is categorized under [CWE-79] and stems from improper neutralization of user-supplied input during web page generation. An unauthenticated attacker can craft a malicious link or payload that, when interacted with by a victim, executes arbitrary JavaScript in the victim's browser session. The exploitation occurs across a scope boundary, allowing attacker-controlled script to impact resources beyond the vulnerable component.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser to steal session tokens, hijack administrator accounts, or deface WordPress sites running Contest Gallery <= 30.0.6.

Affected Products

Contest Gallery WordPress plugin versions <= 30.0.6
WordPress installations using the vulnerable Contest Gallery plugin
Any site exposing Contest Gallery functionality to unauthenticated visitors

Discovery Timeline

2026-07-27 - CVE-2026-65447 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-65447

Vulnerability Analysis

The vulnerability resides in the Contest Gallery plugin's handling of user-controlled input rendered back into HTML output. The plugin fails to properly sanitize or encode input before it is reflected in the response. This allows an attacker to inject arbitrary HTML and JavaScript into rendered pages.

Because the flaw is unauthenticated, no login or existing session with the target site is required. Successful exploitation requires user interaction, typically clicking a crafted link or visiting a malicious page. The scope-changed impact means injected script can access data belonging to other browser contexts or privileged users, including WordPress administrators.

Root Cause

The root cause is missing or insufficient output encoding of user-supplied parameters processed by the plugin. Input flows from HTTP request parameters into HTML sinks without contextual escaping. This class of defect is tracked as [CWE-79], Improper Neutralization of Input During Web Page Generation.

Attack Vector

The attack vector is network-based and requires no privileges. An attacker crafts a URL containing a malicious payload targeting the vulnerable plugin endpoint. The attacker then delivers the URL through phishing, social engineering, or a malicious third-party site. When a victim, particularly an authenticated WordPress administrator, follows the link, the injected script executes with the victim's session privileges. Attackers can then exfiltrate cookies, perform actions on behalf of the user, or pivot to persistent site compromise.

No verified public exploit code is available at this time. Refer to the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-65447

Indicators of Compromise

HTTP requests to Contest Gallery plugin endpoints containing <script>, javascript:, onerror=, or onload= payloads in parameters
Unexpected outbound requests from browsers to attacker-controlled domains following visits to WordPress pages hosting Contest Gallery
WordPress administrator sessions active from unusual IP addresses shortly after clicking external links
Modifications to WordPress users, options, or plugin settings that do not correspond to legitimate admin activity

Detection Strategies

Inspect web server access logs for query strings containing HTML entity or script-tag patterns targeting /wp-content/plugins/contest-gallery/ paths
Deploy Web Application Firewall (WAF) rules that flag reflected script payloads in requests to WordPress plugin endpoints
Monitor Content Security Policy (CSP) violation reports for inline script execution on pages that render Contest Gallery content

Monitoring Recommendations

Enable verbose logging on WordPress and reverse proxies to capture full request URIs and referrers
Alert on WordPress administrator actions originating from sessions created immediately after suspicious link clicks
Track plugin file integrity and configuration changes across production WordPress instances

How to Mitigate CVE-2026-65447

Immediate Actions Required

Identify all WordPress installations running Contest Gallery version 30.0.6 or earlier
Update the Contest Gallery plugin to the latest patched release above 30.0.6
Rotate WordPress administrator passwords and invalidate active sessions if exploitation is suspected
Review recent administrator activity, plugin changes, and user account modifications for signs of abuse

Patch Information

Refer to the Patchstack Vulnerability Report for the current fixed version and vendor advisory information. Apply the vendor-supplied update through the WordPress plugin manager or by replacing the plugin files manually.

Workarounds

Disable the Contest Gallery plugin until the patched version can be deployed
Restrict access to Contest Gallery pages through IP allow-listing or authentication requirements at the reverse proxy
Deploy a WAF ruleset that blocks reflected XSS payloads targeting WordPress plugin parameters
Enforce a strict Content Security Policy that disallows inline script execution on pages rendering user-supplied content

bash

# Disable the Contest Gallery plugin via WP-CLI until patched
wp plugin deactivate contest-gallery

# Verify plugin status
wp plugin status contest-gallery