Contest Gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

• CVE-2026-78088 High 8.8 Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter 0.8%
• CVE-2026-16586 Medium 6.5 Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' 0.6%
• CVE-2026-12165 High 8.8 Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter 0.4%
• CVE-2026-8912 High 7.5 Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection 0.4%
• CVE-2026-4021 High 8.1 Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion 0.5%
• CVE-2026-3180 High 7.5 Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection 1.1%
• CVE-2025-12849 Medium 5.3 Contest Gallery <= 28.0.2 - Missing Authorization 0.3%
• CVE-2025-11254 Medium 4.3 Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection 0.3%
• CVE-2025-10383 Medium 6.4 Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.2 - Authenticated (Author+) Stored Cross-Site Scripting 0.3%
• CVE-2025-7725 High 7.2 Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0 - Unauthenticated Stored Cross-Site Scripting 0.3%
• CVE-2025-6716 Medium 6.4 Contest Gallery <= 26.0.8 - Authenticated (Author+) Stored Cross-Site Scripting 0.2%
• CVE-2025-3862 Medium 6.4 Contest Gallery <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter 0.3%
• CVE-2025-1513 High 7.2 Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 26.0.0.1 - Unauthenticated Stored Cross-Site Scripting 0.3%
• CVE-2024-11103 Critical 9.8 Contest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover 0.8%
• CVE-2024-10687 Critical 9.8 Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 24.0.3 - Unauthenticated SQL Injection 0.6%