Contest Gallery
by WordPress
Source repositories
CVEs (58)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-45848 | Med | 0.40 | 6.1 | 0.00 | Dec 6, 2022 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 13.1.0.9 on WordPress. | ||
| CVE-2024-56237 | Med | 0.38 | 5.9 | 0.00 | Jan 2, 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through <= 24.0.3. | ||
| CVE-2025-3862 | Med | 0.35 | 6.4 | 0.00 | May 8, 2025 | Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 26.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with… | ||
| CVE-2024-43283 | Med | 0.35 | 5.3 | 0.01 | Aug 26, 2024 | Insertion of Sensitive Information Into Sent Data vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through <= 23.1.2. | ||
| CVE-2026-42657 | Med | 0.34 | 5.3 | 0.00 | Jun 15, 2026 | Unauthenticated Other Vulnerability Type in Contest Gallery <= 28.1.7 versions. | ||
| CVE-2025-12849 | Med | 0.34 | 5.3 | 0.00 | Nov 15, 2025 | The Contest Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 28.0.2. This is due to the plugin registering the `cg_check_wp_admin_upload_v10` AJAX action for both authenticated and unauthenticated users without implementing… | ||
| CVE-2022-4157 | Med | 0.32 | 4.9 | 0.01 | Dec 26, 2022 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_option_id POST parameter before concatenating it to an SQL query in export-votes-all.php. This may allow malicious users with administrator privileges… | ||
| CVE-2022-4155 | Med | 0.32 | 4.9 | 0.01 | Dec 26, 2022 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with administrator privileges… | ||
| CVE-2022-4154 | Med | 0.32 | 4.9 | 0.01 | Dec 26, 2022 | The Contest Gallery Pro WordPress plugin before 19.1.5 does not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with at administrator privileges (i.e. on multisite WordPress configurations)… | ||
| CVE-2022-27853 | Med | 0.31 | 4.8 | 0.01 | Apr 18, 2022 | Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) in Contest Gallery (WordPress plugin) <= 13.1.0.9 | ||
| CVE-2026-24965 | Med | 0.28 | 4.3 | 0.00 | Feb 3, 2026 | Missing Authorization vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contest Gallery: from n/a through <= 28.1.1. | ||
| CVE-2025-62950 | Med | 0.28 | 4.3 | 0.00 | Nov 6, 2025 | Cross-Site Request Forgery (CSRF) vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Cross Site Request Forgery.This issue affects Contest Gallery: from n/a through <= 28.0.0. | ||
| CVE-2025-11254 | Med | 0.21 | 4.3 | 0.00 | Oct 11, 2025 | The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 27.0.3 via gallery submissions. This makes it possible for unauthenticated attackers to embed untrusted input into… | ||
| CVE-2026-16055 | Hig | 0.00 | 7.5 | 0.00 | Aug 5, 2026 | The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and… | ||
| CVE-2026-16056 | Med | 0.00 | 4.3 | 0.00 | Aug 4, 2026 | The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history. | ||
| CVE-2026-16057 | Med | 0.00 | 6.5 | 0.00 | Aug 3, 2026 | The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts,… | ||
| CVE-2026-65447 | Hig | 0.00 | 7.1 | 0.00 | Jul 27, 2026 | Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions. | ||
| CVE-2026-57662 | Hig | 0.00 | 8.5 | 0.00 | Jun 26, 2026 | Contributor SQL Injection in Contest Gallery <= 30.0.0 versions. |
- risk 0.40cvss 6.1epss 0.00
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 13.1.0.9 on WordPress.
- risk 0.38cvss 5.9epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through <= 24.0.3.
- risk 0.35cvss 6.4epss 0.00
Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 26.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
- risk 0.35cvss 5.3epss 0.01
Insertion of Sensitive Information Into Sent Data vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through <= 23.1.2.
- risk 0.34cvss 5.3epss 0.00
Unauthenticated Other Vulnerability Type in Contest Gallery <= 28.1.7 versions.
- risk 0.34cvss 5.3epss 0.00
The Contest Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 28.0.2. This is due to the plugin registering the `cg_check_wp_admin_upload_v10` AJAX action for both authenticated and unauthenticated users without implementing…
- risk 0.32cvss 4.9epss 0.01
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_option_id POST parameter before concatenating it to an SQL query in export-votes-all.php. This may allow malicious users with administrator privileges…
- risk 0.32cvss 4.9epss 0.01
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with administrator privileges…
- risk 0.32cvss 4.9epss 0.01
The Contest Gallery Pro WordPress plugin before 19.1.5 does not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with at administrator privileges (i.e. on multisite WordPress configurations)…
- risk 0.31cvss 4.8epss 0.01
Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) in Contest Gallery (WordPress plugin) <= 13.1.0.9
- risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contest Gallery: from n/a through <= 28.1.1.
- risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Cross Site Request Forgery.This issue affects Contest Gallery: from n/a through <= 28.0.0.
- risk 0.21cvss 4.3epss 0.00
The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 27.0.3 via gallery submissions. This makes it possible for unauthenticated attackers to embed untrusted input into…
- risk 0.00cvss 7.5epss 0.00
The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and…
- risk 0.00cvss 4.3epss 0.00
The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history.
- risk 0.00cvss 6.5epss 0.00
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts,…
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.
- risk 0.00cvss 8.5epss 0.00
Contributor SQL Injection in Contest Gallery <= 30.0.0 versions.
Page 3 of 3