Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

Уязвимости

• CVE-2024-30236нужен вход≤ 21.3.4

  WordPress Contest Gallery plugin <= 21.3.4 - SQL Injection vulnerability

  Критич. 9.9

• CVE-2026-25035без авторизации≤ 28.1.2.2

  WordPress Contest Gallery plugin <= 28.1.2.2 - Account Takeover vulnerability

  Критич. 9.8

• CVE-2024-11103без авторизации≤ 24.0.7

  Contest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover

  Критич. 9.8

• CVE-2024-10687без авторизации≤ 24.0.3

  Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 24.0.3 - Unauthenticated

  Критич. 9.8

• CVE-2026-40771без авторизации≤ 28.1.6

  WordPress Contest Gallery plugin <= 28.1.6 - SQL Injection vulnerability

  Критич. 9.3

• CVE-2026-78088без авторизации≤ 32.0.1

  Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter

  Высокий 8.8

• CVE-2024-24887без авторизации · нужен клик≤ 21.2.8.4

  WordPress Contest Gallery Plugin <= 21.2.8.4 is vulnerable to Cross Site Request Forgery (CSRF)

  Высокий 8.8

• CVE-2019-5974без авторизации · нужен клик

  Cross-site request forgery (CSRF) vulnerability in Contest Gallery versions prior to 10.4.5 allows remote attackers to hijack the authentica

  Высокий 8.8

• CVE-2024-30238нужен вход≤ 21.3.2

  WordPress Photos and Files Contest Gallery plugin <= 21.3.2 - SQL Injection vulnerability

  Высокий 8.8

• CVE-2026-12165автор+≤ 30.0.2

  Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter

  Высокий 8.8

• CVE-2022-36394автор+≤ 17.0.4

  WordPress Contest Gallery plugin <= 17.0.4 - Authenticated SQL Injection (SQLi) vulnerability

  Высокий 8.8

• CVE-2026-57662участник+≤ 30.0.0

  WordPress Contest Gallery plugin <= 30.0.0 - SQL Injection vulnerability

  Высокий 8.5

• CVE-2026-4021без авторизации≤ 28.1.5

  Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion

  Высокий 8.1

• CVE-2024-32778нужен вход≤ 21.3.4

  WordPress Contest Gallery plugin <= 21.3.4 - Arbitrary File Deletion vulnerability

  Высокий 8.1

• CVE-2026-8912без авторизации≤ 28.1.6

  Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection

  Высокий 7.5

• CVE-2026-3180без авторизации≤ 28.1.4

  Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection

  Высокий 7.5

• CVE-2024-43283без авторизации≤ 23.1.2

  WordPress Contest Gallery plugin <= 23.1.2 - Unauthenticated Comment UserID And IP address Disclosure vulnerability

  Высокий 7.5

• CVE-2025-7725без авторизации≤ 26.1.0

  Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0

  Высокий 7.2

• CVE-2025-22693высокие права≤ 25.1.0

  WordPress Contest Gallery plugin <= 25.1.0 - SQL Injection vulnerability

  Высокий 7.2

• CVE-2026-61986без авторизации · нужен клик≤ 30.0.5

  WordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scripting (XSS) vulnerability

  Высокий 7.1

• CVE-2026-65447без авторизации · нужен клик≤ 30.0.6

  WordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scripting (XSS) vulnerability

  Высокий 7.1

• CVE-2025-48291без авторизации · нужен клик≤ 26.0.6

  WordPress Contest Gallery <= 26.0.6 - Cross Site Scripting (XSS) Vulnerability

  Высокий 7.1

• CVE-2026-42660подписчик+≤ 28.1.7

  WordPress Contest Gallery plugin <= 28.1.7 - Sensitive Data Exposure vulnerability

  Средний 6.5

• CVE-2026-42656подписчик+≤ 28.1.6

  WordPress Contest Gallery plugin <= 28.1.6 - Cross Site Scripting (XSS) vulnerability

  Средний 6.5

• CVE-2026-16586автор+≤ 30.0.7

  Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRea

  Средний 6.5

• CVE-2026-24964нужен вход≤ 28.1.2.1

  WordPress Contest Gallery plugin <= 28.1.2.1 - Server Side Request Forgery (SSRF) vulnerability

  Средний 6.4

• CVE-2025-10383автор+≤ 27.0.2

  Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.2 - Authenticated (Author+) Stored Cross-Site Scripting

  Средний 6.4

• CVE-2025-6716автор+≤ 26.0.8

  Contest Gallery <= 26.0.8 - Authenticated (Author+) Stored Cross-Site Scripting

  Средний 6.4

• CVE-2025-1513без авторизации≤ 26.0.0.1

  Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 26.0.0.1 - Unauthenticate

  Средний 6.1

• CVE-2024-39631без авторизации · нужен клик≤ 23.1.2

  WordPress Contest Gallery plugin <= 23.1.2 - Cross Site Scripting (XSS) vulnerability

  Средний 6.1

• CVE-2024-30428без авторизации · нужен клик≤ 24.0.3

  WordPress Contest Gallery plugin <= 24.0.3 - Reflected Cross Site Scripting (XSS) vulnerability

  Средний 6.1

• CVE-2023-28784без авторизации · нужен клик≤ 21.1.2

  WordPress Contest Gallery Plugin <= 21.1.2 is vulnerable to Cross Site Scripting (XSS)

  Средний 6.1

• CVE-2022-45848без авторизации · нужен клик≤ 13.1.0.9

  WordPress Contest Gallery Plugin <= 13.1.0.9 is vulnerable to Cross Site Scripting (XSS)

  Средний 6.1

• CVE-2025-3862участник+≤ 26.0.6

  Contest Gallery <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

  Средний 5.4

• CVE-2026-42657без авторизации≤ 28.1.7

  WordPress Contest Gallery plugin <= 28.1.7 - Other Vulnerability Type vulnerability

  Средний 5.3

• CVE-2025-12849без авторизации≤ 28.0.2

  Contest Gallery <= 28.0.2 - Missing Authorization

  Средний 5.3

• CVE-2022-27853автор+≤ 13.1.0.9

  WordPress Contest Gallery plugin <= 13.1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

  Средний 4.8

• CVE-2024-56237высокие права≤ 24.0.3

  WordPress Contest Gallery plugin <= 24.0.3 - Cross Site Scripting (XSS) vulnerability

  Средний 4.8

• CVE-2025-62950без авторизации · нужен клик≤ 28.0.0

  WordPress Contest Gallery plugin <= 28.0.0 - Cross Site Request Forgery (CSRF) vulnerability

  Средний 4.3

• CVE-2025-11254без авторизации · нужен клик≤ 27.0.3

  Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection

  Средний 4.3

• CVE-2026-24965нужен вход≤ 28.1.1

  WordPress Contest Gallery plugin <= 28.1.1 - Broken Access Control vulnerability

  Средний 4.3