CVE-2023-28784
📋 TL;DR
This vulnerability allows unauthenticated attackers to inject malicious scripts into WordPress sites using the Contest Gallery plugin. When users visit a specially crafted URL, the script executes in their browser, potentially stealing session cookies or performing actions on their behalf. All WordPress sites running Contest Gallery plugin version 21.1.2 or earlier are affected.
💻 Affected Systems
- WordPress Contest Gallery Plugin
📦 What is this software?
Contest Gallery by Contest Gallery
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full administrative access to the WordPress site, install backdoors, deface the site, or pivot to internal networks.
Likely Case
Attackers steal user session cookies, perform actions as authenticated users, redirect visitors to malicious sites, or display phishing content.
If Mitigated
With proper input validation and output encoding, malicious scripts are neutralized before execution, preventing any impact.
🎯 Exploit Status
Reflected XSS vulnerabilities are commonly exploited and require minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 21.1.3 or later
Vendor Advisory: https://patchstack.com/database/vulnerability/contest-gallery/wordpress-contest-gallery-plugin-21-1-2-cross-site-scripting-xss-vulnerability
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Contest Gallery plugin. 4. Click 'Update Now' if available. 5. Alternatively, download latest version from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the Contest Gallery plugin until patched.
wp plugin deactivate contest-gallery
Web Application Firewall (WAF)
allConfigure WAF rules to block XSS payloads targeting the vulnerable endpoint.
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution sources.
- Use security plugins like Wordfence or Sucuri that include XSS protection features.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for Contest Gallery version number.Check Version:
wp plugin get contest-gallery --field=versionVerify Fix Applied:
Verify plugin version is 21.1.3 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Unusual GET/POST requests containing script tags or JavaScript payloads to contest gallery pages
- Multiple failed login attempts following suspicious URL visits
Network Indicators:
- HTTP requests with suspicious parameters containing <script>, javascript:, or encoded payloads
SIEM Query:
source="*access.log*" AND ("contest-gallery" OR "cg_" OR "contest_gallery") AND ("<script" OR "javascript:" OR "%3Cscript" OR "onerror=" OR "onload=")🔗 References
- https://patchstack.com/database/vulnerability/contest-gallery/wordpress-contest-gallery-plugin-21-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/contest-gallery/wordpress-contest-gallery-plugin-21-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
