cve-2026-3180

CVE-2026-3180 - WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection Description A Blind SQL Injection vulnerability was discovered in the WordPress Contest Gallery plugin versions 28.1.4 and earlier. The issue occurs due to unsafe use of the cglmaili parameter, where the...

Contest Gallery - Broken Access Control

Contest Gallery from n/a through 23.1.2 contains an exposure of sensitive information to an unauthorized actor caused by insufficient access controls, letting attackers access sensitive data, exploit requires no specific conditions. id: CVE-2024-43283 info: name: Contest Gallery - Broken Access...

WP-Contest-Gallery-28.1.4-Exploit

⚠️ Under Testing This PoC is actively being tested and refined. Features may change between releases. CVE-2026-3180 WordPress Contest Gallery — Unauthenticated Blind SQL Injection Proof-of-concept assessment tool for CVE-2026-3180 Author: Sudeepa Wanigarathna · Original discovery: cardosource...

CVE-2025-62950-PoC

Descrizione Questa proof of concept PoC descrive una vulnerabilità di Cross-Site Request Forgery CSRF trovata nel plugin Contest Gallery – Upload, Vote & Sell with PayPal and Stripe v. 26.1.2. Il problema consente a un attaccante di ingannare un utente autenticato affinché esegua una richiesta...

CVE-2026-61986

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...

CVE-2026-61986

CVE-2026-61986 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress Contest Gallery plugin , affecting versions 30.0.5 and earlier . The flaw allows an unauthenticated attacker to inject malicious scripts, with a CVSS 3.1 base score of 7.1 (HIGH) — network vector, low c...

CVE-2026-61986 WordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...

EUVD-2026-62373

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...

WordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Thaer Assfour in WordPress Plugin Contest Gallery versions = 30.0.5...

WordPress Contest Gallery plugin <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' vulnerability

Authenticated Author+ Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cgmultiplefilesforpost' - 'cgRealId' vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Contest Gallery versions = 30.0.7...

CVE-2026-16586

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cgmultiplefilesforpost' - 'cgRealId' in all versions up to, and including, 30.0.7 due to insufficient escaping ...

CVE-2026-16586

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cgmultiplefilesforpost' - 'cgRealId' in all versions up to, and including, 30.0.7 due to insufficient escaping ...

CVE-2026-16586

CVE-2026-16586 affects the WordPress plugin “Contest Gallery” (all versions up to 30.0.7). It describes a Second-Order SQL Injection via the parameter cgRealId in the function path cg_multiple_files_for_post , caused by insufficient escaping of user input and lack of proper SQL query preparation....

EUVD-2026-58858

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cgmultiplefilesforpost' - 'cgRealId' in all versions up to, and including, 30.0.7 due to insufficient escaping ...

CVE-2026-16586 Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId'

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cgmultiplefilesforpost' - 'cgRealId' in all versions up to, and including, 30.0.7 due to insufficient escaping ...

PT-2026-72157

Name of the Vulnerable Software and Affected Versions The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress versions prior to 30.0.8 Description An issue exists where authenticated attackers with author-level access and above can perform a Second-Order...

CVE-2026-16055

The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication Contest Galle...

CVE-2026-16055 Contest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_login

The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication Contest Galle...

CVE-2026-16055

The CVE concerns the Contest Gallery WordPress plugin prior to 30.0.7. The root cause is that the front-end login bypasses the standard WordPress authentication flow, issuing an authentication cookie immediately after the password check. This bypasses brute-force protection and two-factor authent...

EUVD-2026-53121

The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication Contest Galle...