CVE-2025-11254— Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-11254
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 27.0.3 via gallery submissions. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
CWE-1236
Source: NVD (National Vulnerability Database)
Vulnerability Title
WordPress plugin Contest Gallery – Upload, Vote & Sell with PayPal and Stripe 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress plugin Contest Gallery – Upload, Vote & Sell with PayPal and Stripe 27.0.3及之前版本存在安全漏洞，该漏洞源于未经验证的攻击者可通过图库提交嵌入不可信输入到导
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| contest-gallery | Contest Gallery – Upload, Vote & Sell with PayPal and Stripe | * ~ 27.0.3 | - |
II. Public POCs for CVE-2025-11254
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-11254
请登录查看更多情报信息。
IV. Related Vulnerabilities
- CVE-2026-4021
Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escala - CVE-2026-3180
Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection - CVE-2025-12849
Contest Gallery <= 28.0.2 - Missing Authorization - CVE-2025-10383
Contest Gallery – Upload, Vote & Sell with PayPal and Stripe - CVE-2025-7725
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerc
Same vendor: contest-gallery
- CVE-2026-4021
Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escala - CVE-2026-3180
Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection - CVE-2025-12849
Contest Gallery <= 28.0.2 - Missing Authorization - CVE-2025-10383
Contest Gallery – Upload, Vote & Sell with PayPal and Stripe - CVE-2025-7725
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerc
Same weakness: CWE-1236
- CVE-2026-42267
Kimai: Formula Injection via tag names in XLSX export - CVE-2026-27644
traccar allows CSV formula injection via exported position d - CVE-2023-54348
ERPGo SaaS 3.9 CSV Injection via Vendor Creation - CVE-2026-39424
MaxKB has CSV Injection in its Application Chat Export Funct - CVE-2026-24447
Movable Type 安全漏洞
V. Comments for CVE-2025-11254
No comments yet