CVE-2026-8912 Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection

🗓️ 19 May 2026 11:18:46Reported by WordfenceType

Unauthenticated SQL injection in Contest Gallery plugin up to 28.1.6 via form_input in post_cg_gallery_form_upload.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-8912	19 May 202611:18	–	attackerkb
Circl	CVE-2026-8912	19 May 202620:32	–	circl
CNNVD	WordPress plugin Contest Gallery SQL注入漏洞	19 May 202600:00	–	cnnvd
CVE	CVE-2026-8912	19 May 202611:18	–	cve
EUVD	EUVD-2026-30893	19 May 202611:18	–	euvd
NVD	CVE-2026-8912	19 May 202613:16	–	nvd
Positive Technologies	PT-2026-41885	19 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-8912	5 Jun 202619:11	–	redhatcve
Vulnrichment	CVE-2026-8912 Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection	19 May 202611:18	–	vulnrichment

[
  {
    "vendor": "contest-gallery",
    "product": "Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "28.1.6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/v10/v10-frontend/user_upload/users-upload-check.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/71f2f8c4-00ee-4ab4-b0e0-9ddac46818b3
plugins	www.plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/functions/frontend/cg-general-frontend.php
plugins	www.plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/v10/v10-frontend/user_upload/users-upload-check.php
plugins	www.plugins.trac.wordpress.org/browser/contest-gallery/tags/28.1.5/ajax/ajax-functions-frontend.php

19 May 2026 11:18Current

CVSS 3.17.5

EPSS0.00098

CWE-89