Photo Contest WordPress Plugin Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the Photo Contest, Competition, and Video Contest WordPress plugins, affecting versions through 2.8.1. The issue arises because the plugin fails to properly sanitize and escape a parameter before displaying it on the page. This vulnerability could be exploited against users with high privileges, such as administrators.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, which could be used to target high-privilege users like admins.

Remediation

Users are advised to update to version 2.9.0 or later, where this vulnerability has been fixed.