Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons

Information

Software Type Plugin
Software Slug contest-gallery (view on wordpress.org)
Software Status Active
Software Author contest-gallery
Software Downloads 344,745
Software Active Installs 1,000
Software Record Last Updated December 10, 2024

Showing 1-20 of 36 Vulnerabilities

Title Status CVE ID CVSS Researchers Date
Photos and Files Contest Gallery <= 21.3.2 - Authenticated (Contributor+) SQL Injection Patched CVE-2024-30238 9.9 LVT-tholv2k March 26, 2024
Photos and Files Contest Gallery <= 21.3.4 - Authenticated (Contributor+) SQL Injection Patched CVE-2024-30236 9.9 Emili Castells March 26, 2024
Contest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover Patched CVE-2024-11103 9.8 shaman0x01 November 27, 2024
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 24.0.3 - Unauthenticated SQL Injection Patched CVE-2024-10687 9.8 shaman0x01 November 4, 2024
Contest Gallery – Photo Contest Plugin for WordPress <= 13.1.0.5 - SQL Injection Patched CVE-2021-24915 9.8 Tyler Miller April 13, 2022
Contest Gallery (Pro) <= 19.1.5 - SQL Injection via option_id Patched CVE-2022-4150 8.8 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 17.0.4 - Authenticated (Author+) SQL Injection Patched CVE-2022-36394 8.8 Nguy Minh Tuan August 9, 2022
Contest Gallery – Photo Contest Plugin for WordPress <= 10.4.4 - Cross-Site Request Forgery Patched CVE-2019-5974 8.8 Okazawa Yoshihiro June 12, 2019
Contest Gallery <= 19.1.5 - Unauthenticated SQL Injection via user_id Patched CVE-2022-4156 8.1 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Unauthenticated SQL Injection via cg_Fields Patched CVE-2022-4158 8.1 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via option_id GET Patched CVE-2022-4152 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via addCountS Patched CVE-2022-4166 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_row Patched CVE-2022-4162 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_order Patched CVE-2022-4165 7.5 Daniel Krohmer, Kunal Sharma December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_copy_start Patched CVE-2022-4161 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_copy_id Patched CVE-2022-4160 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.5 - Authenticated (Author+) SQL Injection via upload[] Patched CVE-2022-4153 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_multiple_files_for_post Patched CVE-2022-4164 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via wp_user_id Patched CVE-2022-4155 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022
Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_option_id Patched CVE-2022-4157 7.5 Kunal Sharma, Daniel Krohmer December 5, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation