653 matches found
CVE-2026-111837
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wasiliy Strecker Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through 34.0.1...
CVE-2026-111837 WordPress Contest Gallery plugin <= 34.0.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wasiliy Strecker Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through 34.0.1...
CVE-2026-111837
The Wasiliy Strecker Contest Gallery WordPress plugin (versions
EUVD-2026-107276
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wasiliy Strecker Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through 34.0.1...
CVE-2026-107447
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and...
CVE-2026-107447 Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter Identity
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and...
CVE-2026-107447
The Contest Gallery WordPress plugin (versions prior to 34.0.1 ) contains a vulnerability where it fails to reliably validate visitor identity for its one-vote-per-entry restriction. The flaw stems from the plugin trusting a client-supplied request header and an unbound client-generated token . T...
CVE-2026-107447 Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter Identity
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and...
WordPress Contest Gallery plugin < 34.0.1 - Unauthenticated Vote Restriction Bypass vulnerability
Unauthenticated Vote Restriction Bypass vulnerability discovered by Nicat Sultanov in WordPress Plugin Contest Gallery versions 34.0.1...
EUVD-2026-107146
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and...
CVE-2025-62950-PoC
Description This proof of concept PoC describes a Cross-Site Request Forgery CSRF vulnerability found in the Contest Gallery – Upload, Vote & Sell with PayPal and Stripe v. 26.1.2 plugin. The issue allows an attacker to trick an authenticated user into executing a crafted request that...
PT-2026-120503
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and...
PT-2026-120618
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wasiliy Strecker Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through 34.0.1...
Contest Gallery - Broken Access Control
Contest Gallery from n/a through 23.1.2 contains an exposure of sensitive information to an unauthorized actor caused by insufficient access controls, letting attackers access sensitive data, exploit requires no specific conditions. id: CVE-2024-43283 info: name: Contest Gallery - Broken Access...
WP-Contest-Gallery-28.1.4-Exploit
⚠️ Under Testing This PoC is actively being tested and refined. Features may change between releases. CVE-2026-3180 WordPress Contest Gallery — Unauthenticated Blind SQL Injection Proof-of-concept assessment tool for CVE-2026-3180 Author: Sudeepa Wanigarathna · Original discovery: cardosource...
WordPress Contest Gallery plugin <= 34.0.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by beopseong.kim in WordPress Plugin Contest Gallery versions = 34.0.1...
cve-2026-3180
CVE-2026-3180 - WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection Description A Blind SQL Injection vulnerability was discovered in the WordPress Contest Gallery plugin versions 28.1.4 and earlier. The issue occurs due to unsafe use of the cglmaili parameter, where the...
CVE-2026-107120
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to ...
CVE-2026-107120
The Contest Gallery WordPress plugin, in versions prior to 33.0.1 , is vulnerable to an unauthenticated email verification bypass. The root cause is a failure to limit the number of attempts against the front-end registration email-verification step, which utilizes a short numeric PIN . An attack...
EUVD-2026-96126
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to ...