CVE-2025-11254

The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 27.0.3 via gallery submissions. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/changeset/3375891/contest-gallery/tags/28.0.0/functions/backend/render/cg-backend-gallery-general.php?old=3372123&old_path=contest-gallery%2Ftags%2F27.0.3%2Ffunctions%2Fbackend%2Frender%2Fcg-backend-gallery-general.php
https://plugins.trac.wordpress.org/changeset?old_path=/contest-gallery/tags/27.0.3&new_path=/contest-gallery/tags/28.0.0&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/9a0dc62c-786d-40f3-b9c9-bd199a176192?source=cve

Configurations

No configuration.

History

08 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) El plugin Contest Gallery - Upload, Vote & Sell with PayPal and Stripe para WordPress es vulnerable a Inyección CSV en todas las versiones hasta la 27.0.3, inclusive, a través de envíos a la galería. Esto permite que atacantes no autenticados incrusten entradas no confiables en archivos CSV exportados, lo que puede resultar en ejecución de código cuando estos archivos se descargan y abren en un sistema local con una configuración vulnerable.

Information

Published : 2025-10-11 09:15

Updated : 2026-10-08 13:10

NVD link : CVE-2025-11254

Mitre link : CVE-2025-11254

CVE.ORG link : CVE-2025-11254

JSON object : View

Products Affected

No product.

CWE

CWE-1236

Improper Neutralization of Formula Elements in a CSV File

{"id": "CVE-2025-11254", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11254", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T13:30:49.664443Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "contest-gallery", "product": "Contest Gallery \u2013 Upload & Vote Photos, Media, Sell with PayPal & Stripe", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "27.0.3"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-11T09:15:32.453", "references": [{"url": "https://plugins.trac.wordpress.org/changeset/3375891/contest-gallery/tags/28.0.0/functions/backend/render/cg-backend-gallery-general.php?old=3372123&old_path=contest-gallery%2Ftags%2F27.0.3%2Ffunctions%2Fbackend%2Frender%2Fcg-backend-gallery-general.php", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/contest-gallery/tags/27.0.3&new_path=/contest-gallery/tags/28.0.0&sfp_email=&sfph_mail=", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9a0dc62c-786d-40f3-b9c9-bd199a176192?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-1236"}]}], "descriptions": [{"lang": "en", "value": "The Contest Gallery \u2013 Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 27.0.3 via gallery submissions. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration."}, {"lang": "es", "value": "El plugin Contest Gallery - Upload, Vote & Sell with PayPal and Stripe para WordPress es vulnerable a Inyecci\u00f3n CSV en todas las versiones hasta la 27.0.3, inclusive, a trav\u00e9s de env\u00edos a la galer\u00eda. Esto permite que atacantes no autenticados incrusten entradas no confiables en archivos CSV exportados, lo que puede resultar en ejecuci\u00f3n de c\u00f3digo cuando estos archivos se descargan y abren en un sistema local con una configuraci\u00f3n vulnerable."}], "lastModified": "2026-10-08T13:10:00.200", "sourceIdentifier": "security@wordfence.com"}