EUVD-2026-36980

Unauthenticated SQL Injection in Contest Gallery = 28.1.6 versions...

EUVD-2026-36821

Subscriber Cross Site Scripting XSS in Contest Gallery = 28.1.6 versions...

PT-2026-49447

Subscriber Cross Site Scripting XSS in Contest Gallery = 28.1.6 versions...

PT-2026-49415

Unauthenticated SQL Injection in Contest Gallery = 28.1.6 versions...

EUVD-2026-30893

The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the 'forminput' parameter in versions up to, and including, 28.1.6. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query inside the unauthenticat...

WordPress Contest Gallery plugin <= 28.1.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Contest Gallery versions = 28.1.6...