Log in Start free

Contest Gallery

Products

ProductCVEsExploitedLatest
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe15–Sep 16, 2026
Contest Gallery2–Jun 22, 2023
Contest Gallery (WordPress plugin)2–Aug 23, 2022
Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress1–Feb 12, 2024

Exploited and recent CVEs

  • CVE-2026-78088 High 8.8 Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter 0.8%
  • CVE-2026-16586 Medium 6.5 Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' 0.6%
  • CVE-2026-12165 High 8.8 Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter 0.4%
  • CVE-2026-8912 High 7.5 Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection 0.4%
  • CVE-2026-4021 High 8.1 Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion 0.5%
  • CVE-2026-3180 High 7.5 Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection 1.1%
  • CVE-2025-12849 Medium 5.3 Contest Gallery <= 28.0.2 - Missing Authorization 0.3%
  • CVE-2025-11254 Medium 4.3 Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection 0.3%
  • CVE-2025-10383 Medium 6.4 Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.2 - Authenticated (Author+) Stored Cross-Site Scripting 0.3%
  • CVE-2025-7725 High 7.2 Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0 - Unauthenticated Stored Cross-Site Scripting 0.3%
  • CVE-2025-6716 Medium 6.4 Contest Gallery <= 26.0.8 - Authenticated (Author+) Stored Cross-Site Scripting 0.2%
  • CVE-2025-3862 Medium 6.4 Contest Gallery <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter 0.3%
  • CVE-2025-1513 High 7.2 Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 26.0.0.1 - Unauthenticated Stored Cross-Site Scripting 0.3%
  • CVE-2024-11103 Critical 9.8 Contest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover 0.8%
  • CVE-2024-10687 Critical 9.8 Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 24.0.3 - Unauthenticated SQL Injection 0.6%
  • CVE-2024-24887 Medium 5.4 WordPress Contest Gallery Plugin <= 21.2.8.4 is vulnerable to Cross Site Request Forgery (CSRF) 0.2%
  • CVE-2023-28784 High 7.1 WordPress Contest Gallery Plugin <= 21.1.2 is vulnerable to Cross Site Scripting (XSS) 0.4%
  • CVE-2022-45848 Medium 6.1 WordPress Contest Gallery Plugin <= 13.1.0.9 is vulnerable to Cross Site Scripting (XSS) 0.4%
  • CVE-2022-36394 High 7.6 WordPress Contest Gallery plugin <= 17.0.4 - Authenticated SQL Injection (SQLi) vulnerability 1.0%
  • CVE-2022-27853 Medium 4.8 WordPress Contest Gallery plugin <= 13.1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability 0.5%