- Description
- The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Name and Comment field when commenting on photo gallery entries in all versions up to, and including, 26.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Source
- security@wordfence.com
- NVD status
- Analyzed
CVSS 3.1
- Type
- Primary
- Base score
- 6.1
- Impact score
- 2.7
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity
- MEDIUM
- Hype score
- Not currently trending
🚨 CVE-2025-1513 🔴 HIGH (7.2) 🏢 contest-gallery - Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons 🏗️ * 🔗 https://t.co/2eauadlLy4 🔗 https://t.co/exkY10ysXa #CyberCron #VulnAlert http
@cybercronai
1 Mar 2025
36 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-1513 Stored XSS Vulnerability in WordPress Photo Gallery Plugin via Com... https://t.co/MahG4EGU7Y Customizable Vulnerability Alerts: https://t.co/U7998fz7yk
@VulmonFeeds
28 Feb 2025
10 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
�� CVE-2025-1513 - WordPress - HIGH 🚨 🗓️ Date published 2025-02-28 06:15:25 UTC #WordPress #CyberSecurity #InfoSec #Vulnerability #TechNews https://t.co/6VXCKE2rYa
@vulns_space
28 Feb 2025
3 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:contest-gallery:contest_gallery:*:*:*:*:*:wordpress:*:*",
"vulnerable": true,
"matchCriteriaId": "92383DCE-86AC-40B0-B684-9393B4D05996",
"versionEndExcluding": "26.0.1"
}
],
"operator": "OR"
}
]
}
]