WordPress plugin · contest-gallery
Is Contest Gallery safe?
Safe on 34.0.3 or newer.
The current version, 34.0.3, is past every affected range on record (49 of 50 records list one; 1 doesn’t, so check it below). Keep it updated and you’re clear of them.
- Flaws on record
- 50
- High or critical
- 26
- Exploited
- none
- Current version
- 34.0.3
- Last updated
- Oct 28, 2026
- Active installs
- 1,000+
Every recorded flaw
- Oct 21, 2026Contest Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111837 · affects up to 34.0.1 · reported by PatchstackMedium 6.5
- Oct 21, 2026Contest Gallery: Does not reliably validate the visitor identity used to enforce its one-vote-per-entry restrictionCVE-2026-107447 · fixed in 34.0.1 · reported by WPScanMedium 5.3
- Oct 10, 2026Contest Gallery: Does not limit the number of attempts against its front-end registration email-verification stepCVE-2026-107120 · fixed in 33.0.1 · reported by WPScanMedium 5.3
- Sep 16, 2026Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe: Unauthenticated Arbitrary File OverwriteCVE-2026-78088 · affects up to 32.0.1 · reported by WordfenceHigh 8.8
- Aug 19, 2026Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.5 versions.CVE-2026-61986 · affects up to 30.0.5 · reported by PatchstackHigh 7.1
- Aug 15, 2026Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe: Second-Order SQL InjectionCVE-2026-16586 · affects up to 30.0.7 · reported by WordfenceMedium 6.5
- Aug 5, 2026Contest Gallery: Does not route its front-end login through the standard WordPress authentication flowCVE-2026-16055 · fixed in 30.0.7 · reported by WPScanHigh 7.5
- Aug 4, 2026Contest Gallery: Does not perform any capability or nonce check in one of its handlersCVE-2026-16056 · fixed in 30.0.7 · reported by WPScanMedium 4.3
- Aug 3, 2026Contest Gallery: Does not perform per-object capability or nonce checks in one of its post-deletion handlersCVE-2026-16057 · fixed in 30.0.7 · reported by WPScanMedium 6.5
- Jul 27, 2026Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.CVE-2026-65447 · affects up to 30.0.6 · reported by PatchstackHigh 7.1
- Jun 26, 2026Contributor SQL Injection in Contest Gallery <= 30.0.0 versions.CVE-2026-57662 · reported by PatchstackHigh 8.5
- Jun 17, 2026Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe: Privilege EscalationCVE-2026-12165 · affects up to 30.0.2 · reported by WordfenceHigh 8.8
- Jun 15, 2026Subscriber Sensitive Data Exposure in Contest Gallery <= 28.1.7 versions.CVE-2026-42660 · affects up to 28.1.7 · reported by PatchstackMedium 6.5
- Jun 15, 2026Unauthenticated Other Vulnerability Type in Contest Gallery <= 28.1.7 versions.CVE-2026-42657 · affects up to 28.1.7 · reported by PatchstackMedium 5.3
- Jun 15, 2026Subscriber Cross Site Scripting (XSS) in Contest Gallery <= 28.1.6 versions.CVE-2026-42656 · affects up to 28.1.6 · reported by PatchstackMedium 6.5
- Jun 15, 2026Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions.CVE-2026-40771 · affects up to 28.1.6 · reported by PatchstackCritical 9.3
- May 19, 2026Contest Gallery: SQL InjectionCVE-2026-8912 · affects up to 28.1.6 · reported by WordfenceHigh 7.5
- Mar 25, 2026Contest Gallery: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-25035 · affects up to 28.1.2.2 · reported by PatchstackCritical 9.8
- Mar 25, 2026Contest Gallery: Server-Side Request Forgery (SSRF)CVE-2026-24964 · affects up to 28.1.2.1 · reported by PatchstackMedium 6.4
- Mar 23, 2026Contest Gallery: An authentication bypass leading to admin account takeoverCVE-2026-4021 · affects up to 28.1.5 · reported by WordfenceHigh 8.1
- Mar 2, 2026Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe: Blind SQL InjectionCVE-2026-3180 · affects up to 28.1.4 · reported by Wordfence1.1% oddsHigh 7.5
- Feb 3, 2026Contest Gallery: Missing AuthorizationCVE-2026-24965 · affects up to 28.1.1 · reported by PatchstackMedium 4.3
- Nov 15, 2025Contest Gallery: Authorization bypassCVE-2025-12849 · affects up to 28.0.2 · reported by WordfenceMedium 5.3
- Nov 6, 2025Contest Gallery: Cross-Site Request Forgery (CSRF)CVE-2025-62950 · affects up to 28.0.0 · reported by PatchstackMedium 4.3
- Oct 11, 2025Contest Gallery – Upload, Vote & Sell with PayPal and Stripe: CSV InjectionCVE-2025-11254 · affects up to 27.0.3 · reported by WordfenceMedium 4.3
- Oct 4, 2025Contest Gallery – Upload, Vote & Sell with PayPal and Stripe: Stored Cross-Site ScriptingCVE-2025-10383 · affects up to 27.0.2 · reported by WordfenceMedium 6.4
- Aug 1, 2025The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI pluginCVE-2025-7725 · affects up to 26.1.0 · reported by WordfenceHigh 7.2
- Jul 16, 2025Contest Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48291 · affects up to 26.0.6 · reported by PatchstackHigh 7.1
- Jul 11, 2025The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI pluginCVE-2025-6716 · affects up to 26.0.8 · reported by WordfenceMedium 6.4
- May 8, 2025Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 26.0.6 due to insCVE-2025-3862 · affects up to 26.0.6 · reported by WordfenceMedium 6.4
- Feb 28, 2025The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons plugin for WorCVE-2025-1513 · affects up to 26.0.0.1 · reported by WordfenceHigh 7.2
- Feb 3, 2025Contest Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22693 · affects up to 25.1.0 · reported by PatchstackHigh 7.6
- Jan 2, 2025Contest Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56237 · affects up to 24.0.3 · reported by PatchstackMedium 5.9
- Nov 28, 2024Contest Gallery: Privilege escalationCVE-2024-11103 · affects up to 24.0.7 · reported by WordfenceCritical 9.8
- Nov 5, 2024The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons plugin for WordPress is CVE-2024-10687 · affects up to 24.0.3 · reported by WordfenceCritical 9.8
- Aug 26, 2024Contest Gallery: Insertion of Sensitive Information Into Sent DataCVE-2024-43283 · affects up to 23.1.2 · reported by Patchstack1.1% oddsMedium 5.3
- Aug 1, 2024Contest Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-39631 · affects up to 23.1.2 · reported by PatchstackHigh 7.1
- Jun 9, 2024Contest Gallery: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-32778 · affects up to 21.3.4 · reported by PatchstackHigh 7.7
- Mar 29, 2024Contest Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30428 · affects up to 24.0.3 · reported by PatchstackHigh 7.1
- Mar 28, 2024Contest Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30236 · affects up to 21.3.4 · reported by PatchstackHigh 8.5
- Mar 27, 2024Contest Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30238 · affects up to 21.3.2 · reported by PatchstackHigh 8.5
- Mar 11, 2024Photos and Files Contest Gallery: Does not sanitize and escape some parametersCVE-2024-1487 · fixed in 21.3.1 · reported by WPScanMedium 5.4
- Feb 12, 2024Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for: Cross-Site Request Forgery (CSRF)CVE-2024-24887 · affects up to 21.2.8.4 · reported by PatchstackMedium 5.4
- Oct 31, 2023Photos and Files Contest Gallery: Does not sanitise and escape some parametersCVE-2023-5307 · fixed in 21.2.8.1 · reported by WPScanMedium 6.1
- Jun 22, 2023Unauth.CVE-2023-28784 · affects up to 21.1.2 · reported by PatchstackHigh 7.1
- Dec 6, 2022Unauth.CVE-2022-45848 · affects up to 13.1.0.9 · reported by PatchstackMedium 6.1
- Aug 23, 2022Authenticated (author+) SQL Injection (SQLi) vulnerability in Contest Gallery plugin <= 17.0.4 at WordPress.CVE-2022-36394 · affects up to 17.0.4 · reported by PatchstackHigh 7.6
- Apr 18, 2022Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) in Contest Gallery (WordPress plugin) <= 13.1.0.9CVE-2022-27853 · affects up to 13.1.0.9 · reported by PatchstackMedium 4.8
- Nov 29, 2021Contest Gallery: Does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statementCVE-2021-24915 · fixed in 13.1.0.6 · reported by WPScan12% oddsCritical 9.8
- Jul 5, 2019Contest Gallery versions prior to 10.4.5: Cross-site request forgery (CSRF)CVE-2019-5974 · fixed in 10.4.5 · reported by vultures@jpcert.or.jp1.0% oddsHigh 8.8
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.