Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
Contest Gallery - Broken Access Control (CVE-2025-12849)
The Contest Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 28.0.2. This is due to the plugin registering the `cg_check_wp_admin_upload_v10` AJAX action for both authenticated and unauthenticated users without implementing capability checks or nonce verification. This makes it possible for unauthenticated attackers to inject arbitrary WordPress media attachments into galleries and manipulate gallery metadata via the `cg_check_wp_admin_upload_v10` action. It does not enable an attacker to move or upload files.
PLUGIN
Contest Gallery
CVE-2025-12849
Risk Score
Threat Entry
Updated 2026-06-17
Contest Gallery - Cross-Site Request Forgery (CSRF) (CVE-2025-62950)
Cross-Site Request Forgery (CSRF) vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Cross Site Request Forgery.This issue affects Contest Gallery: from n/a through
PLUGIN
Contest Gallery
CVE-2025-62950
Risk Score
Threat Entry
Updated 2026-06-17
Contest Gallery - Security Vulnerability (CVE-2025-11254)
The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 27.0.3 via gallery submissions. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
PLUGIN
Contest Gallery
CVE-2025-11254
Risk Score
Threat Entry
Updated 2026-06-17
Contest Gallery - Cross-Site Scripting (XSS) (CVE-2025-10383)
The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple form field parameters in all versions up to, and including, 27.0.2. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with author-level access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Contest Gallery
CVE-2025-10383
Risk Score
Threat Entry
Updated 2026-06-17
Contest Gallery - Cross-Site Scripting (XSS) (CVE-2025-48291)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through
PLUGIN
Contest Gallery
CVE-2025-48291
Risk Score
Threat Entry
Updated 2026-06-17
Contest Gallery - Cross-Site Scripting (XSS) (CVE-2025-3862)
Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 26.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Contest Gallery
CVE-2025-3862
Risk Score
Threat Entry
Updated 2026-06-17
Contest Gallery - Cross-Site Scripting (XSS) (CVE-2025-1513)
The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Name and Comment field when commenting on photo gallery entries in all versions up to, and including, 26.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Contest Gallery
CVE-2025-1513
Risk Score
Threat Entry
Updated 2026-06-17
Contest Gallery - SQL Injection (CVE-2025-22693)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows SQL Injection.This issue affects Contest Gallery: from n/a through
PLUGIN
Contest Gallery
CVE-2025-22693
Risk Score
Threat Entry
Updated 2026-06-17
Contest Gallery - Cross-Site Scripting (XSS) (CVE-2024-56237)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through
PLUGIN
Contest Gallery
CVE-2024-56237
Risk Score
Threat Entry
Updated 2026-06-17
Contest Gallery - Privilege Escalation (CVE-2024-11103)
The Contest Gallery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 24.0.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
PLUGIN
Contest Gallery
CVE-2024-11103
Risk Score
Threat Entry
Updated 2026-06-17
Contest Gallery - SQL Injection (CVE-2024-10687)
The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons plugin for WordPress is vulnerable to time-based SQL Injection via the $collectedIds parameter in all versions up to, and including, 24.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Contest Gallery
CVE-2024-10687
Risk Score
Threat Entry
Updated 2026-06-17
Contest Gallery - Information Disclosure (CVE-2024-43283)
Insertion of Sensitive Information Into Sent Data vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through
PLUGIN
Contest Gallery
CVE-2024-43283
Risk Score
Threat Entry
Updated 2026-06-17
Contest Gallery - Cross-Site Scripting (XSS) (CVE-2024-39631)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through
PLUGIN
Contest Gallery
CVE-2024-39631
Risk Score
Threat Entry
Updated 2026-06-17
Contest Gallery - Path Traversal (CVE-2024-32778)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through
PLUGIN
Contest Gallery
CVE-2024-32778
Risk Score
Threat Entry
Updated 2026-06-17
Contest Gallery - Cross-Site Scripting (XSS) (CVE-2024-30428)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Reflected XSS.This issue affects Contest Gallery: from n/a through
PLUGIN
Contest Gallery
CVE-2024-30428
Risk Score
Threat Entry
Updated 2026-06-17
Contest Gallery - SQL Injection (CVE-2024-30236)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through
PLUGIN
Contest Gallery
CVE-2024-30236
Risk Score
Threat Entry
Updated 2026-06-17
Contest Gallery - SQL Injection (CVE-2024-30238)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through
PLUGIN
Contest Gallery
CVE-2024-30238
Risk Score
Threat Entry
Updated 2026-06-17
Contest Gallery - Cross-Site Scripting (XSS) (CVE-2024-1487)
The Photos and Files Contest Gallery WordPress plugin before 21.3.1 does not sanitize and escape some parameters, which could allow users with a role as low as author to perform Cross-Site Scripting attacks.
PLUGIN
Contest Gallery
CVE-2024-1487
Risk Score
Threat Entry
Updated 2026-06-17
Contest Gallery - Cross-Site Request Forgery (CSRF) (CVE-2024-24887)
Cross-Site Request Forgery (CSRF) vulnerability in Contest Gallery Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress.This issue affects Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress: from n/a through 21.2.8.4.
PLUGIN
Contest Gallery
CVE-2024-24887
Risk Score
Threat Entry
Updated 2026-06-17
Contest Gallery - Cross-Site Scripting (XSS) (CVE-2023-5307)
The Photos and Files Contest Gallery WordPress plugin before 21.2.8.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks via certain headers.
PLUGIN
Contest Gallery
CVE-2023-5307
Risk Score