Contest Gallery - Broken Access Control

Contest Gallery from n/a through 23.1.2 contains an exposure of sensitive information to an unauthorized actor caused by insufficient access controls, letting attackers access sensitive data, exploit requires no specific conditions. id: CVE-2024-43283 info: name: Contest Gallery - Broken Access...

cve-2026-3180

CVE-2026-3180 - WordPress Contest Gallery 28.1.4 - 認証なしブラインドSQLインジェクション 説明 WordPress Contest Gallery プラグインのバージョン 28.1.4 およびそれ以前 において、ブラインドSQLインジェクション Blind SQL Injection の脆弱性が発見されました。この問題は、cglmaili パラメータの安全でない使用に起因し、sanitizeemail 関数がメールアドレスのローカル部分で一重引用符 ' を保持するために発生します。その結果、ユーザー制御の入力が prepare...

CVE-2025-62950-PoC

説明 この概念実証（PoC）は、Contest Gallery – Upload, Vote & Sell with PayPal and Stripe v. 26.1.2 プラグインで発見されたクロスサイトリクエストフォージェリ（CSRF）脆弱性について説明しています。この問題により、攻撃者は認証済みユーザーを騙して、ユーザーの同意なしにギャラリー項目を意図せず削除する細工されたリクエストを実行させ、不正なコンテンツ損失を引き起こし、データ整合性に影響を与える可能性があります。 詳細 脆弱性タイプ : クロスサイトリクエストフォージェリ（CSRF） 影響を受けるプラグイン : 影響...

WP-Contest-Gallery-28.1.4-Exploit

⚠️ 테스트 중 이 PoC는 현재 적극적으로 테스트 및 개선 중입니다. 릴리스 간에 기능이 변경될 수 있습니다. CVE-2026-3180 WordPress Contest Gallery — 인증되지 않은 블라인드 SQL 인젝션 CVE-2026-3180에 대한 개념 증명 평가 도구 작성자: Sudeepa Wanigarathna · 최초 발견: cardosource !IMPORTANT 승인된 사용만 허용됩니다. 이 도구는 보안 연구, 교육, 그리고 귀하가 소유하거나 명시적인 서면 허가를 받은 시스템을 테스트하기 위한 것입니다. 컴퓨터...

WordPress Contest Gallery plugin < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_login vulnerability

Unauthenticated Login-Protection and 2FA Bypass via postcglogin vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Contest Gallery versions 30.0.7...

CVE-2026-78088

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...

CVE-2026-78088 Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...

EUVD-2026-80098

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...

CVE-2026-78088

The Contest Gallery WordPress plugin (Upload & Vote Photos, Media, Sell with PayPal & Stripe) versions up to and including 32.0.1 are affected by an Unauthenticated Arbitrary File Overwrite vulnerability caused by insufficient file path validation in the 'baseUrlForFacebook' parameter . Attackers...

CVE-2026-78088 Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...

PT-2026-93271

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...

CVE-2026-78088: Unrestricted Upload of File with Dangerous Type

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...

WordPress Contest Gallery plugin <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter vulnerability

Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter vulnerability discovered by mad4cyber - nonprofit in WordPress Plugin Contest Gallery versions = 32.0.1...

CVE-2026-61986

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...

CVE-2026-61986 WordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...

CVE-2026-61986

CVE-2026-61986 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress Contest Gallery plugin , affecting versions 30.0.5 and earlier . The flaw allows an unauthenticated attacker to inject malicious scripts, with a CVSS 3.1 base score of 7.1 (HIGH) — network vector, low c...

EUVD-2026-62373

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...

CVE-2026-61986 WordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...

WordPress Contest Gallery plugin < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library vulnerability

Author+ Arbitrary Post Deletion via postcgyoutubedeletefromlibrary vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Contest Gallery versions 30.0.7...

WordPress Contest Gallery plugin < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_prompts vulnerability

Subscriber+ OpenAI Prompt History Disclosure via postcggetopenaiprompts vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Contest Gallery versions 30.0.7...