VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe security & vulnerabilities

contest-gallery— active installsLast vulnerability Nov 11, 2026

No known unpatched vulnerabilities in the latest version

All 70 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
70Known vulnerabilities
  • Critical5
  • High30
  • Medium35
  • Low0
Vulnerabilities per year
2019: 1 vulnerability1192021: 2 vulnerabilities2212022: 20 vulnerabilities20222023: 2 vulnerabilities2232024: 12 vulnerabilities12242025: 10 vulnerabilities10252026: 23 vulnerabilities2326

All Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe vulnerabilities

Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe vulnerabilities
SeverityVulnerabilityCVEPublished
High8.8Authenticated (Author+) Arbitrary File Upload
<34.0.3Update to 34.0.3
CVE-2026-118041
High8.8Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter
≤32.0.1Update to 33.0.0
CVE-2026-78088
High7.2Unauthenticated Stored Cross-Site Scripting
≤30.0.5Update to 30.0.6
CVE-2026-61986
High7.2Unauthenticated Stored Cross-Site Scripting
≤30.0.6Update to 30.0.7
CVE-2026-65447
High8.8Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter
≤30.0.2Update to 30.0.3
CVE-2026-12165
High7.5Unauthenticated SQL Injection
≤28.1.6Update to 28.1.7
CVE-2026-8912
High7.5Unauthenticated SQL Injection
≤28.1.6Update to 28.1.7
CVE-2026-40771
High8.1Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion
≤28.1.5Update to 28.1.6
CVE-2026-4021
High7.5Unauthenticated SQL Injection
≤28.1.4Update to 28.1.5
CVE-2026-3180
High7.2Unauthenticated Stored Cross-Site Scripting
≤26.1.0Update to 26.1.1
CVE-2025-7725
High7.2Unauthenticated Stored Cross-Site Scripting
≤26.0.0.1Update to 26.0.1
CVE-2025-1513
Critical9.8Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover
≤24.0.7Update to 24.0.8
CVE-2024-11103
Critical9.8Unauthenticated SQL Injection
≤24.0.3Update to 24.0.4
CVE-2024-10687
Critical9.9Authenticated (Contributor+) SQL Injection
≤21.3.2Update to 21.3.2.1
CVE-2024-30238
Critical9.9Authenticated (Contributor+) SQL Injection
≤21.3.4Update to 21.3.5
CVE-2024-30236
High7.5Authenticated (Author+) SQL Injection via wp_user_id
≤19.1.4.1Update to 19.1.5
CVE-2022-4155
High7.5Authenticated (Author+) SQL Injection via cg_option_id
≤19.1.4.1Update to 19.1.5
CVE-2022-4157
High8.1Unauthenticated SQL Injection via user_id
≤19.1.5Update to 19.1.5.1
CVE-2022-4156
High7.5Authenticated (Author+) SQL Injection via cg_copy_id
≤19.1.4.1Update to 19.1.5
CVE-2022-4160
High7.5Authenticated (Author+) SQL Injection via addCountS
≤19.1.4.1Update to 19.1.5
CVE-2022-4166
High7.5Authenticated (Author+) SQL Injection via cg_row
≤19.1.4.1Update to 19.1.5
CVE-2022-4162
High7.5Authenticated (Author+) SQL Injection via cg_order
≤19.1.4.1Update to 19.1.5
CVE-2022-4165
High7.5Authenticated (Author+) SQL Injection via option_id GET
≤19.1.4.1Update to 19.1.5
CVE-2022-4152
High8.1Unauthenticated SQL Injection via cg_Fields
≤19.1.4.1Update to 19.1.5
CVE-2022-4158
High7.5Authenticated (Author+) SQL Injection via cg_copy_start
≤19.1.4.1Update to 19.1.5
CVE-2022-4161
High8.8SQL Injection via option_id
≤19.1.5Update to 19.1.5.1
CVE-2022-4150
High7.5Authenticated (Author+) SQL Injection via cg_multiple_files_for_post
≤19.1.4.1Update to 19.1.5
CVE-2022-4164
High7.5Authenticated (Author+) SQL Injection via cg_id
≤19.1.5Update to 19.1.5.1
CVE-2022-4159
High7.5Authenticated (Author+) SQL Injection via upload[]
≤19.1.5Update to 19.1.5.1
CVE-2022-4153
High7.5Authenticated (Author+) SQL Injection via option_id
≤19.1.4.1Update to 19.1.5
CVE-2022-4151
High7.5Authenticated (Author+) SQL Injection via cg_activate and cg_deactivate
≤19.1.4.1Update to 19.1.5
CVE-2022-4163
High8.8Authenticated (Author+) SQL Injection
≤17.0.4Update to 17.0.5
CVE-2022-36394
High7.2Admin+ SQL Injection
≤17.0.4Update to 17.0.5
—
Critical9.8SQL Injection
≤13.1.0.5Update to 13.1.0.6
CVE-2021-24915
High8.8Cross-Site Request Forgery
≤10.4.4Update to 10.4.5
CVE-2019-5974

Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe: common questions

Does Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe have known vulnerabilities?

Yes. VulnCrest Radar lists 70 known vulnerabilities in Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe: 5 critical, 30 high, 35 medium. None are known to affect version null.

How do I check which version of Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe vulnerability?

CVE-2026-118041, published Nov 11, 2026: Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe < 34.0.3 - Authenticated (Author+) Arbitrary File Upload. Severity: High (CVSS 8.8).

Is any Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe vulnerability listed in CISA KEV?

No. None of the known Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?