Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Competition Plugin for WordPress

Information

Software Type Plugin
Software Slug contest-gallery (view on wordpress.org)
Software Status Active
Software Author contest-gallery
Software Downloads 321,776
Software Active Installs 1,000
Software Record Last Updated April 19, 2024

Showing 1-20 of 28 Vulnerabilities

4.7
CVE ID Unknown
Jan 9, 2024
Researchers:
Title CVE ID CVSS Researchers Date
Contest Gallery <= 21.3.5 - Reflected Cross-Site Scripting CVE-2024-30428 6.1 Dimas Maulana March 28, 2024
Contest Gallery <= 21.2.8.4 - Cross-Site Request Forgery CVE-2024-24887 4.3 Dhabaleshwar Das February 5, 2024
Contest Gallery <= 21.2.8.4 - Cross-Site Request Forgery 4.7 January 9, 2024
Contest Gallery < 21.2.8.1 - Unauthenticated Stored Cross-Site Scripting via headers CVE-2023-5307 6.1 Dmitrii Ignatyev October 10, 2023
Contest Gallery <= 21.1.2 - Reflected Cross-Site Scripting CVE-2023-28784 6.1 thiennv March 27, 2023
Contest Gallery <= 19.1.5 - Authenticated (Author+) SQL Injection via upload[] CVE-2022-4153 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery (Pro) <= 19.1.5 - SQL Injection via option_id CVE-2022-4150 8.8 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via addCountS CVE-2022-4166 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_row CVE-2022-4162 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_order CVE-2022-4165 7.5 Daniel Krohmer, Kunal Sharma December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via option_id GET CVE-2022-4152 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_copy_start CVE-2022-4161 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_copy_id CVE-2022-4160 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_multiple_files_for_post CVE-2022-4164 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via wp_user_id CVE-2022-4155 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_option_id CVE-2022-4157 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Unauthenticated SQL Injection via cg_Fields CVE-2022-4158 8.1 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.5 - Authenticated (Author+) SQL Injection via cg_id CVE-2022-4159 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.5 - Unauthenticated SQL Injection via user_id CVE-2022-4156 8.1 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_activate and cg_deactivate CVE-2022-4163 7.5 Kunal Sharma, Daniel Krohmer November 29, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation