Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress

Information

Software Type Plugin
Software Slug contest-gallery (view on wordpress.org)
Software Status Active
Software Author contest-gallery
Software Downloads 305,565
Software Active Installs 1,000
Software Record Last Updated September 24, 2023

Showing 1-20 of 24 vulnerabilities

Contest Gallery <= 21.1.2 - Reflected Cross-Site Scripting
6.1
CVE-2023-28784
Mar 27, 2023
Researcher: thiennv
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_option_id
7.5
CVE-2022-4157
Dec 5, 2022
Researchers: Kunal Sharma, Daniel Krohmer
Contest Gallery (Pro) <= 19.1.5 - SQL Injection via option_id
8.8
CVE-2022-4150
Dec 5, 2022
Researchers: Kunal Sharma, Daniel Krohmer
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via addCountS
7.5
CVE-2022-4166
Dec 5, 2022
Researchers: Kunal Sharma, Daniel Krohmer
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_row
7.5
CVE-2022-4162
Dec 5, 2022
Researchers: Kunal Sharma, Daniel Krohmer
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_order
7.5
CVE-2022-4165
Dec 5, 2022
Researchers: Daniel Krohmer, Kunal Sharma
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via option_id GET
7.5
CVE-2022-4152
Dec 5, 2022
Researchers: Kunal Sharma, Daniel Krohmer
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_copy_start
7.5
CVE-2022-4161
Dec 5, 2022
Researchers: Kunal Sharma, Daniel Krohmer
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_copy_id
7.5
CVE-2022-4160
Dec 5, 2022
Researchers: Kunal Sharma, Daniel Krohmer
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_multiple_files_for_post
7.5
CVE-2022-4164
Dec 5, 2022
Researchers: Kunal Sharma, Daniel Krohmer
Contest Gallery <= 19.1.5 - Authenticated (Author+) SQL Injection via upload[]
7.5
CVE-2022-4153
Dec 5, 2022
Researchers: Kunal Sharma, Daniel Krohmer
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via wp_user_id
7.5
CVE-2022-4155
Dec 5, 2022
Researchers: Kunal Sharma, Daniel Krohmer
Contest Gallery <= 19.1.4.1 - Unauthenticated SQL Injection via cg_Fields
8.1
CVE-2022-4158
Dec 5, 2022
Researchers: Kunal Sharma, Daniel Krohmer
Contest Gallery <= 19.1.5 - Authenticated (Author+) SQL Injection via cg_id
7.5
CVE-2022-4159
Dec 5, 2022
Researchers: Kunal Sharma, Daniel Krohmer
Contest Gallery <= 19.1.5 - Unauthenticated SQL Injection via user_id
8.1
CVE-2022-4156
Dec 5, 2022
Researchers: Kunal Sharma, Daniel Krohmer
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_activate and cg_deactivate
7.5
CVE-2022-4163
Nov 29, 2022
Researchers: Kunal Sharma, Daniel Krohmer
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via option_id
7.5
CVE-2022-4151
Nov 29, 2022
Researchers: Kunal Sharma, Daniel Krohmer
Contest Gallery <= 13.1.0.9 - Cross-Site Scripting
6.1
CVE-2022-45848
Nov 23, 2022
Researcher: thiennv
Contest Gallery <= 17.0.4 - Authenticated (Author+) SQL Injection
8.8
CVE-2022-36394
Aug 9, 2022
Researcher: Nguy Minh Tuan
Contest Gallery – Files Upload and Contest Plugin for WordPress <= 17.0.4 - Admin+ SQL Injection
7.2
CVE ID Unknown
Jun 1, 2022
Researchers:
Title CVE ID CVSS Researchers Date
Contest Gallery <= 21.1.2 - Reflected Cross-Site Scripting CVE-2023-28784 6.1 thiennv March 27, 2023
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_option_id CVE-2022-4157 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery (Pro) <= 19.1.5 - SQL Injection via option_id CVE-2022-4150 8.8 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via addCountS CVE-2022-4166 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_row CVE-2022-4162 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_order CVE-2022-4165 7.5 Daniel Krohmer, Kunal Sharma December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via option_id GET CVE-2022-4152 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_copy_start CVE-2022-4161 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_copy_id CVE-2022-4160 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_multiple_files_for_post CVE-2022-4164 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.5 - Authenticated (Author+) SQL Injection via upload[] CVE-2022-4153 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via wp_user_id CVE-2022-4155 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Unauthenticated SQL Injection via cg_Fields CVE-2022-4158 8.1 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.5 - Authenticated (Author+) SQL Injection via cg_id CVE-2022-4159 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.5 - Unauthenticated SQL Injection via user_id CVE-2022-4156 8.1 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_activate and cg_deactivate CVE-2022-4163 7.5 Kunal Sharma, Daniel Krohmer November 29, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via option_id CVE-2022-4151 7.5 Kunal Sharma, Daniel Krohmer November 29, 2022
Contest Gallery <= 13.1.0.9 - Cross-Site Scripting CVE-2022-45848 6.1 thiennv November 23, 2022
Contest Gallery <= 17.0.4 - Authenticated (Author+) SQL Injection CVE-2022-36394 8.8 Nguy Minh Tuan August 9, 2022
Contest Gallery – Files Upload and Contest Plugin for WordPress <= 17.0.4 - Admin+ SQL Injection 7.2 June 1, 2022

All the threat data shared in this database is powered by Wordfence Intelligence Enterprise.
Interested in integrating this data into your platform or network?
Contact us now to discuss API access to our Wordfence Intelligence Enterprise Data Feeds.

Inquire Now

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation