Introduction
Malicious JavaScript injected through a simple contest comment can compromise every visitor to a WordPress site running Contest Gallery. The flaw affects any site using the plugin up to version 26.1.0. An attacker needs no authentication, and the injected code persists on the site and runs in users' browsers.
About the software: Contest Gallery is a specialized WordPress plugin for running photo and video contests. It supports uploads, voting, e-commerce via PayPal and Stripe, and social sharing. It has over 1,000 active installations and is maintained by Wasiliy Strecker. The plugin is widely used in niche communities and by small businesses that rely on user engagement and media-driven campaigns.
Technical Information
CVE-2025-7725 is a stored cross-site scripting vulnerability in the comment feature of the Contest Gallery WordPress plugin, present in all versions up to and including 26.1.0. The root cause is insufficient input sanitization and output escaping in comment handling. When a user submits a comment, the plugin does not properly sanitize the input or escape the output before rendering it on the gallery or entry page. An attacker can therefore inject arbitrary JavaScript payloads, which are stored in the WordPress database.
When another user visits a page containing the malicious comment, the JavaScript executes in their browser context. The attack requires no authentication, so any external attacker can carry it out. The flaw resembles XSS issues reported earlier in this plugin, which also came from improper handling of user input in various fields. As of this writing, no public source has published code snippets or exploit payloads.
Affected Systems and Versions
- Contest Gallery WordPress plugin
- All versions up to and including 26.1.0
- Any WordPress site with the plugin installed and comments enabled is vulnerable
Vendor Security History
The Contest Gallery plugin has had multiple XSS vulnerabilities in 2025:
- CVE-2025-3862: XSS via 'id' parameter (≤ 26.0.6)
- CVE-2025-1513: XSS via Name and Comment fields (≤ 26.0.0.1)
- CVE-2025-6716: Authenticated (Author+) stored XSS
- CVE-2025-48291: Stored XSS (≤ 26.0.6)
The vendor has released security fixes in several minor versions, but similar flaws keep recurring. That points to ongoing problems with secure coding, particularly input validation and output escaping. The vendor's response has been reactive, with updates arriving after public disclosure.
