What’s Vulnerable › Products
Contest Gallery Pro vulnerabilities
54 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 18 published in the last 12 months.
Check whether your Contest Gallery Pro version is affected
Latest Contest Gallery Pro vulnerabilities
- CVE-2026-78088 — Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter (CVSS 8.8)
- CVE-2026-16586 — Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' (CVSS 6.5)
- CVE-2026-65447 — WordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-12165 — Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter (CVSS 8.8)
- CVE-2026-8912 — Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection (CVSS 7.5)
- CVE-2026-25035 — WordPress Contest Gallery plugin <= 28.1.2.2 - Account Takeover vulnerability (CVSS 9.8)
- CVE-2026-24964 — WordPress Contest Gallery plugin <= 28.1.2.1 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4)
- CVE-2026-4021 — Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion (CVSS 8.1)
- CVE-2026-3180 — Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection (CVSS 7.5)
- CVE-2026-24965 — WordPress Contest Gallery plugin <= 28.1.1 - Broken Access Control vulnerability (CVSS 4.3)
- CVE-2025-12849 — Contest Gallery <= 28.0.2 - Missing Authorization (CVSS 5.3)
- CVE-2025-62950 — WordPress Contest Gallery plugin <= 28.0.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- CVE-2025-11254 — Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection (CVSS 4.3)
- CVE-2025-10383 — Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.2 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4)
- CVE-2025-7725 — Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- CVE-2025-48291 — WordPress Contest Gallery <= 26.0.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1)
- CVE-2025-6716 — Contest Gallery <= 26.0.8 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4)
- CVE-2025-3862 — Contest Gallery <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 5.4)
- CVE-2025-1513 — Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 26.0.0.1 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.1)
- CVE-2025-22693 — WordPress Contest Gallery plugin <= 25.1.0 - SQL Injection vulnerability (CVSS 7.2)
- CVE-2024-56237 — WordPress Contest Gallery plugin <= 24.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 4.8)
- CVE-2024-11103 — Contest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover (CVSS 9.8)
- CVE-2024-10687 — Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 24.0.3 - Unauthenticated SQL Injection (CVSS 9.8)
- CVE-2024-43283 — WordPress Contest Gallery plugin <= 23.1.2 - Unauthenticated Comment UserID And IP address Disclosure vulnerability (CVSS 7.5)
- CVE-2024-39631 — WordPress Contest Gallery plugin <= 23.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.1)