CVE-2025-1513
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Published Feb 28, 2025
Updated: Mar 6, 2025
CWE ID 79
Summary
CVE-2025-1513: This vulnerability affects the Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery plugin for WordPress. The issue lies in the insufficient input sanitization and output escaping of the Name and Comment field when commenting on photo gallery entries. As a result, unauthenticated attackers can inject arbitrary web scripts, which will execute whenever a user accesses an injected page, posing a significant cross-site scripting risk. Versions up to and including 26.0.0.1 are vulnerable.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Contest-gallery Contest Gallery