Live › vulnerability › CVE-2026-111837
Go to dashboardContest Gallery, a WordPress plugin by Wasiliy Strecker, fails to neutralize input before writing it into web pages, so it stores attacker-supplied script. A visitor whose browser loads the affected page can have script run in the context of the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Contest Gallery plugin at version or earlier are in the affected range. The sources do not describe which plugin features or configurations make a site exposed, so the exact data path is unknown. Sites that do not run this plugin can skip it.
34.0.1No product ranges from the sources yet.
wp-content/plugins/contest-gallery/.34.0.1; the sources do not name the first fixed release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through 34.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-111837")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.