---
id: CVE-2025-11254
title: >-
  The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for
  WordPress is vulnerable to CSV Injection in all versions up to, and including,
  27.0.3 via gallery submissions
summary: >-
  The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for
  WordPress is vulnerable to CSV Injection in all versions up to, and including,
  27.0.3 via gallery submissions. This makes it possible for unauthenticated
  attacke…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cwe:
  - CWE-1236
published: '2025-10-11'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T13:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-11254'
references:
  - url: >-
      https://plugins.trac.wordpress.org/changeset/3375891/contest-gallery/tags/28.0.0/functions/backend/render/cg-backend-gallery-general.php?old=3372123&old_path=contest-gallery%2Ftags%2F27.0.3%2Ffunctions%2Fbackend%2Frender%2Fcg-backend-gallery-general.php
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?old_path=/contest-gallery/tags/27.0.3&new_path=/contest-gallery/tags/28.0.0&sfp_email=&sfph_mail=
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/9a0dc62c-786d-40f3-b9c9-bd199a176192?source=cve
    label: security@wordfence.com
tags:
  - nvd
epss: 0.00342
epssPercentile: 0.25645
ingestedAt: '2026-10-08T13:42:55.099Z'
---

## Overview

The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 27.0.3 via gallery submissions. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.