Description

Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-19T13:17:49.090Z",
  "pubdate": "2026-08-19T13:17:49.090Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Contest Gallery plugin for versions 30.0.5 and below. This security flaw permits unauthenticated remote threat actors to inject and execute arbitrary client-side scripts, specifically JavaScript or HTML, within the context of a victim's browser session. The primary risk implication includes potential session hijacking, unauthorized actions performed on behalf of authenticated users, defacement of the affected web application, and redirection to malicious external resources. The vulnerability resides within the input handling mechanisms of the affected product, where user-supplied parameters are insufficiently sanitized or encoded before being reflected back to the user interface. Exploitation requires no prior authentication or administrative privileges, allowing arbitrary network-based attackers to interact with the vulnerable application endpoints. Successful exploitation depends on the victim interacting with the malicious payload, typically via crafted URLs or links leading to the affected Contest Gallery components. Organizations utilizing vulnerable versions face significant integrity and confidentiality risks regarding their web application users.",
  "technicalDetails": "The vulnerability is classified as an unauthenticated Cross-Site Scripting (XSS) flaw affecting Contest Gallery versions 30.0.5 and prior. The root cause stems from improper input validation and output encoding within the vulnerable component, where parameters supplied by HTTP requests are dynamically rendered in the Document Object Model (DOM) without adequate sanitization. Specifically, the application fails to neutralize special characters such as angle brackets (< and >), quotes, and event handlers before reflecting them in the HTTP response. Because the attack vector requires no authentication requirements and zero privilege requirements, any remote attacker operating over network exposure can initiate the attack sequence. The exploitation method involves crafting a malicious HTTP request or URL containing an encoded script payload within vulnerable input vectors handled by Contest Gallery. When an unsuspecting user navigates to the maliciously crafted URL, the web server processes the request and returns a response containing the unescaped input. The victim's browser parses the HTTP response, interpreting the attacker-supplied data as executable markup rather than inert string data. The payload behavior executes immediately within the security context of the victim's session, enabling the execution of arbitrary JavaScript. This grants the attacker the ability to access Document object properties, manipulate DOM elements, steal sensitive session tokens or cookies stored in local storage, and perform unauthorized asynchronous requests (XMLHttpRequest or Fetch API) acting as the authenticated user. Post-exploitation impact varies depending on the targeted user's privileges, ranging from standard user account compromise to administrative takeover if an administrator interacts with the malicious payload."
}