Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

Information

Software Type Plugin
Software Slug contest-gallery (view on wordpress.org)
Software Status Active
Software Author contest-gallery
Software Website www.contest-gallery.com
Software Downloads 397,657
Software Active Installs 1,000
Software Record Last Updated July 15, 2026

Showing 1-20 of 59 Vulnerabilities

Submit a Vulnerability
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 30.0.0 - Authenticated (Contributor+) SQL Injection
6.5
CVE-2026-57662
Jun 26, 2026
Researcher: Trương Hữu Phúc (truonghuuphuc)
Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter
8.8
CVE-2026-12165
Jun 16, 2026
Researchers: Chloe Chamberland, PRISM
Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection
7.5
CVE-2026-8912
May 18, 2026
Researcher: Leonid Semenenko (lsemenenko)
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.7 - Missing Authorization
5.3
CVE-2026-42657
Apr 29, 2026
Researcher: endy
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.7 - Authenticated (Subscriber+) Sensitive Information Exposure
4.3
CVE-2026-42660
Apr 29, 2026
Researcher: Jakub Herman
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2026-42656
Apr 29, 2026
Researcher: endy
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.6 - Unauthenticated SQL Injection
7.5
CVE-2026-40771
Apr 21, 2026
Researcher: Trương Hữu Phúc (truonghuuphuc)
Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion
8.1
CVE-2026-4021
Mar 23, 2026
Researcher: Supakiad S. (m3ez)
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.2.2 - Missing Authorization
5.3
CVE-2026-25035
Mar 23, 2026
Researcher: daroo
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery
6.4
CVE-2026-24964
Mar 10, 2026
Researcher: lilmingwa13
Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection
7.5
CVE-2026-3180
Mar 2, 2026
Researcher: Thomas Sanzey
Contest Gallery <= 28.1.1 - Missing Authorization
4.3
CVE-2026-24965
Jan 9, 2026
Researcher: lilmingwa13
Contest Gallery <= 28.0.2 - Missing Authorization
5.3
CVE-2025-12849
Nov 14, 2025
Researcher: type5afe
Contest Gallery <= 28.0.0 - Cross-Site Request Forgery
4.3
CVE-2025-62950
Oct 12, 2025
Researcher: Lorenzo Camilli
Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection
4.3
CVE-2025-11254
Oct 10, 2025
Researcher: Aurélien BOURDOIS (Elymaro)
Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.2 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2025-10383
Oct 3, 2025
Researcher: Aurélien BOURDOIS (Elymaro)
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2025-7725
Jul 31, 2025
Researcher: zer0gh0st
Contest Gallery <= 26.0.6 - Reflected Cross-Site Scripting
6.1
CVE-2025-48291
Jul 11, 2025
Researcher: domiee13
Contest Gallery <= 26.0.8 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2025-6716
Jul 10, 2025
Researcher: Aurélien BOURDOIS (Elymaro)
Contest Gallery <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
6.4
CVE-2025-3862
May 7, 2025
Researcher: stealthcopter
Title Status CVE ID CVSS Researchers Date
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 30.0.0 - Authenticated (Contributor+) SQL Injection Patched CVE-2026-57662 6.5 Trương Hữu Phúc (truonghuuphuc) June 26, 2026
Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter Patched CVE-2026-12165 8.8 Chloe Chamberland, PRISM June 16, 2026
Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection Patched CVE-2026-8912 7.5 Leonid Semenenko (lsemenenko) May 18, 2026
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.7 - Missing Authorization Patched CVE-2026-42657 5.3 endy April 29, 2026
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.7 - Authenticated (Subscriber+) Sensitive Information Exposure Patched CVE-2026-42660 4.3 Jakub Herman April 29, 2026
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting Patched CVE-2026-42656 6.4 endy April 29, 2026
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.6 - Unauthenticated SQL Injection Patched CVE-2026-40771 7.5 Trương Hữu Phúc (truonghuuphuc) April 21, 2026
Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion Patched CVE-2026-4021 8.1 Supakiad S. (m3ez) March 23, 2026
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.2.2 - Missing Authorization Patched CVE-2026-25035 5.3 daroo March 23, 2026
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery Patched CVE-2026-24964 6.4 lilmingwa13 March 10, 2026
Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection Patched CVE-2026-3180 7.5 Thomas Sanzey March 2, 2026
Contest Gallery <= 28.1.1 - Missing Authorization Patched CVE-2026-24965 4.3 lilmingwa13 January 9, 2026
Contest Gallery <= 28.0.2 - Missing Authorization Patched CVE-2025-12849 5.3 type5afe November 14, 2025
Contest Gallery <= 28.0.0 - Cross-Site Request Forgery Patched CVE-2025-62950 4.3 Lorenzo Camilli October 12, 2025
Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection Patched CVE-2025-11254 4.3 Aurélien BOURDOIS (Elymaro) October 10, 2025
Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.2 - Authenticated (Author+) Stored Cross-Site Scripting Patched CVE-2025-10383 6.4 Aurélien BOURDOIS (Elymaro) October 3, 2025
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2025-7725 7.2 zer0gh0st July 31, 2025
Contest Gallery <= 26.0.6 - Reflected Cross-Site Scripting Patched CVE-2025-48291 6.1 domiee13 July 11, 2025
Contest Gallery <= 26.0.8 - Authenticated (Author+) Stored Cross-Site Scripting Patched CVE-2025-6716 6.4 Aurélien BOURDOIS (Elymaro) July 10, 2025
Contest Gallery <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter Patched CVE-2025-3862 6.4 stealthcopter May 7, 2025

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation