VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe security & vulnerabilities

contest-gallery— active installsLast vulnerability Nov 11, 2026

No known unpatched vulnerabilities in the latest version

All 70 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
70Known vulnerabilities
  • Critical5
  • High30
  • Medium35
  • Low0
Vulnerabilities per year
2019: 1 vulnerability1192021: 2 vulnerabilities2212022: 20 vulnerabilities20222023: 2 vulnerabilities2232024: 12 vulnerabilities12242025: 10 vulnerabilities10252026: 23 vulnerabilities2326

All Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe vulnerabilities

Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe vulnerabilities
SeverityVulnerabilityCVEPublished
High8.8Authenticated (Author+) Arbitrary File Upload
<34.0.3Update to 34.0.3
CVE-2026-118041
Medium5.3Missing Authorization
<34.0.1Update to 34.0.1
CVE-2026-107447
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤34.0.1Update to 34.0.2
CVE-2026-111837
Medium5.3Unauthenticated Unauthorized Account Activation
≤33.0.0Update to 33.0.1
CVE-2026-107120
High8.8Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter
≤32.0.1Update to 33.0.0
CVE-2026-78088
High7.2Unauthenticated Stored Cross-Site Scripting
≤30.0.5Update to 30.0.6
CVE-2026-61986
Medium6.5Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId'
≤30.0.7Update to 31.0.0
CVE-2026-16586
Medium5.3Unauthenticated Two-Factor Authentication Bypass
≤30.0.6Update to 30.0.7
CVE-2026-16055
High7.2Unauthenticated Stored Cross-Site Scripting
≤30.0.6Update to 30.0.7
CVE-2026-65447
Medium4.3Missing Authorization
≤30.0.6Update to 30.0.7
CVE-2026-16056
Medium4.3Missing Authorization
≤30.0.6Update to 30.0.7
CVE-2026-16057
Medium6.5Authenticated (Contributor+) SQL Injection
≤30.0.0Update to 30.0.1
CVE-2026-57662
High8.8Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter
≤30.0.2Update to 30.0.3
CVE-2026-12165
High7.5Unauthenticated SQL Injection
≤28.1.6Update to 28.1.7
CVE-2026-8912
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤28.1.6Update to 29.0.0
CVE-2026-42656
Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure
≤28.1.7Update to 29.0.0
CVE-2026-42660
Medium5.3Missing Authorization
≤28.1.7Update to 29.0.0
CVE-2026-42657
High7.5Unauthenticated SQL Injection
≤28.1.6Update to 28.1.7
CVE-2026-40771
High8.1Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion
≤28.1.5Update to 28.1.6
CVE-2026-4021
Medium5.3Missing Authorization
≤28.1.2.2Update to 28.1.3
CVE-2026-25035
Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
≤28.1.2.1Update to 28.1.2.2
CVE-2026-24964
High7.5Unauthenticated SQL Injection
≤28.1.4Update to 28.1.5
CVE-2026-3180
Medium4.3Missing Authorization
≤28.1.1Update to 28.1.2
CVE-2026-24965
Medium5.3Missing Authorization
≤28.0.2Update to 28.0.3
CVE-2025-12849
Medium4.3Cross-Site Request Forgery
≤28.0.0Update to 28.0.1
CVE-2025-62950
Medium4.3Unauthenticated CSV Injection
≤27.0.3Update to 28.0.0
CVE-2025-11254
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤27.0.2Update to 27.0.3
CVE-2025-10383
High7.2Unauthenticated Stored Cross-Site Scripting
≤26.1.0Update to 26.1.1
CVE-2025-7725
Medium6.1Reflected Cross-Site Scripting
≤26.0.6Update to 26.0.7
CVE-2025-48291
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤26.0.8Update to 26.0.9
CVE-2025-6716
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
≤26.0.6Update to 26.0.7
CVE-2025-3862
High7.2Unauthenticated Stored Cross-Site Scripting
≤26.0.0.1Update to 26.0.1
CVE-2025-1513
Medium6.5Authenticated (Author+) SQL Injection
≤25.1.0Update to 25.1.2
CVE-2025-22693
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤24.0.3Update to 24.0.4
CVE-2024-56237
Critical9.8Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover
≤24.0.7Update to 24.0.8
CVE-2024-11103
Critical9.8Unauthenticated SQL Injection
≤24.0.3Update to 24.0.4
CVE-2024-10687
Medium5.3Unauthenticated Information Exposure
≤23.1.2Update to 23.1.3
CVE-2024-43283
Medium6.1Unauthenticated Stored Cross-Site Scripting
≤23.1.2Update to 23.1.3
CVE-2024-39631
Medium4.3Authenticated (Author+) Arbitrary File Deletion
≤21.3.4Update to 21.3.5
CVE-2024-32778
Medium6.1Reflected Cross-Site Scripting
≤21.3.5Update to 21.3.6
CVE-2024-30428
Critical9.9Authenticated (Contributor+) SQL Injection
≤21.3.2Update to 21.3.2.1
CVE-2024-30238
Critical9.9Authenticated (Contributor+) SQL Injection
≤21.3.4Update to 21.3.5
CVE-2024-30236
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤21.3.0Update to 21.3.1
CVE-2024-1487
Medium4.3Cross-Site Request Forgery
≤21.2.8.4Update to 21.2.9
CVE-2024-24887
Medium4.7Cross-Site Request Forgery
≤21.2.8.4Update to 21.2.9
—
Medium6.1Unauthenticated Stored Cross-Site Scripting via headers
<21.2.8.1Update to 21.2.8.1
CVE-2023-5307
Medium6.1Reflected Cross-Site Scripting
≤21.1.2Update to 21.1.2.1
CVE-2023-28784
High7.5Authenticated (Author+) SQL Injection via wp_user_id
≤19.1.4.1Update to 19.1.5
CVE-2022-4155
High7.5Authenticated (Author+) SQL Injection via cg_option_id
≤19.1.4.1Update to 19.1.5
CVE-2022-4157
High8.1Unauthenticated SQL Injection via user_id
≤19.1.5Update to 19.1.5.1
CVE-2022-4156
High7.5Authenticated (Author+) SQL Injection via cg_copy_id
≤19.1.4.1Update to 19.1.5
CVE-2022-4160
High7.5Authenticated (Author+) SQL Injection via addCountS
≤19.1.4.1Update to 19.1.5
CVE-2022-4166
High7.5Authenticated (Author+) SQL Injection via cg_row
≤19.1.4.1Update to 19.1.5
CVE-2022-4162
High7.5Authenticated (Author+) SQL Injection via cg_order
≤19.1.4.1Update to 19.1.5
CVE-2022-4165
High7.5Authenticated (Author+) SQL Injection via option_id GET
≤19.1.4.1Update to 19.1.5
CVE-2022-4152
High8.1Unauthenticated SQL Injection via cg_Fields
≤19.1.4.1Update to 19.1.5
CVE-2022-4158
High7.5Authenticated (Author+) SQL Injection via cg_copy_start
≤19.1.4.1Update to 19.1.5
CVE-2022-4161
High8.8SQL Injection via option_id
≤19.1.5Update to 19.1.5.1
CVE-2022-4150
High7.5Authenticated (Author+) SQL Injection via cg_multiple_files_for_post
≤19.1.4.1Update to 19.1.5
CVE-2022-4164
High7.5Authenticated (Author+) SQL Injection via cg_id
≤19.1.5Update to 19.1.5.1
CVE-2022-4159
High7.5Authenticated (Author+) SQL Injection via upload[]
≤19.1.5Update to 19.1.5.1
CVE-2022-4153
High7.5Authenticated (Author+) SQL Injection via option_id
≤19.1.4.1Update to 19.1.5
CVE-2022-4151
High7.5Authenticated (Author+) SQL Injection via cg_activate and cg_deactivate
≤19.1.4.1Update to 19.1.5
CVE-2022-4163
Medium6.1Cross-Site Scripting
≤13.1.0.9Update to 14.0.0
CVE-2022-45848
High8.8Authenticated (Author+) SQL Injection
≤17.0.4Update to 17.0.5
CVE-2022-36394
High7.2Admin+ SQL Injection
≤17.0.4Update to 17.0.5
—
Critical9.8SQL Injection
≤13.1.0.5Update to 13.1.0.6
CVE-2021-24915
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤13.1.0.9Update to 14.0.0
CVE-2022-27853
Medium4.3Authenticated Email Address Disclosure
<13.1.0.7Update to 13.1.0.7
—
High8.8Cross-Site Request Forgery
≤10.4.4Update to 10.4.5
CVE-2019-5974

Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe: common questions

Does Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe have known vulnerabilities?

Yes. VulnCrest Radar lists 70 known vulnerabilities in Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe: 5 critical, 30 high, 35 medium. None are known to affect version null.

How do I check which version of Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe vulnerability?

CVE-2026-118041, published Nov 11, 2026: Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe < 34.0.3 - Authenticated (Author+) Arbitrary File Upload. Severity: High (CVSS 8.8).

Is any Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe vulnerability listed in CISA KEV?

No. None of the known Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?