Unrated severityNVD Advisory· Published Dec 26, 2022· Updated Apr 11, 2025

Contest Gallery < 19.1.5 - Author+ SQL Injection

CVE-2022-4166

Description

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the addCountS POST parameter before concatenating it to an SQL query in 4_activate.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Contest Gallerycpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <19.1.5.1
Package: https://wordpress.org/plugins/contest-gallery
Contest Gallery/Contest Galleryllm-fuzzy
Range: <19.1.5.1

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/6e7de2bb-5f71-4c27-ae79-4f6b2ba7f86fmitreexploitvdb-entrytechnical-description
bulletin.iese.de/post/contest-gallery_19-1-4-1_12mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000