CVE-2025-1513

High

Published: 28 February 2025

Published

28 February 2025

Modified

06 March 2025

KEV Added

—

Patch

—

CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS Score 0.0054 68.0th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1513 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Contest-Gallery Contest Gallery. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 32.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-1513 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79, in the Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons plugin for WordPress. It affects all versions up to and including 26.0.0.1 due to insufficient input sanitization and output escaping in the Name and Comment fields when users comment on photo gallery entries. This flaw enables the injection of arbitrary web scripts into pages, with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating high severity due to its network accessibility, low complexity, lack of privileges or user interaction required, and changed scope.

Unauthenticated attackers can exploit the vulnerability by submitting malicious scripts via the Name or Comment fields during photo gallery comments. The injected scripts are then stored persistently and execute in the browser context of any user who views the affected page, potentially compromising confidentiality and integrity through actions like stealing cookies, session tokens, or sensitive data displayed on the page.

Advisories reference a patch in the WordPress plugin trac repository at changeset 3245199 for the contest-gallery repository, indicating remediation through an updated plugin version. Wordfence threat intelligence provides further details on the vulnerability at their dedicated page.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-5476

Vulnerability details

The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Name and Comment field when commenting on photo…

gallery entries in all versions up to, and including, 26.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1185 Browser Session Hijacking Collection

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

attack.mitre.org →

T1539 Steal Web Session Cookie Credential Access

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

attack.mitre.org →

Why these techniques?

Stored XSS in public-facing WordPress plugin directly enables T1190 exploitation; facilitates browser session hijacking (T1185) and web session cookie theft (T1539) via injected scripts.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1