Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe — Vulnerabilities & Security Advisories 15

All 15 CVE vulnerabilities found in Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities affecting the Contest Gallery plugin, a WordPress extension designed for uploading photos, media voting, and selling digital goods via PayPal and Stripe. The collection compiles identified weaknesses across various categories, including cross-site scripting, unauthorized access, and improper input validation, documenting incidents reported over the past several years. Readers can utilize this resource to track the vendor’s advisory history, understand common vulnerability classes associated with file handling and payment integration, and review the specific vulnerability timeline for this product. By examining these records, security professionals and site administrators gain insight into recurring risk patterns and the effectiveness of past remediation efforts. This data supports informed decision-making regarding plugin maintenance, patching schedules, and potential exposure in live environments where user-generated content and financial transactions are processed. The focus remains on factual reporting of security flaws, enabling users to assess the long-term stability and safety profile of the application within their broader digital infrastructure.

Vendor: contest-gallery

CVE ID Title CVSS Severity Published
CVE-2026-78088 Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter CWE-434 8.8 High 2026-09-16
CVE-2026-16586 Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' CWE-89 6.5 Medium 2026-08-15
CVE-2026-12165 Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter CWE-269 8.8 High 2026-06-17
CVE-2026-8912 Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection CWE-89 7.5 High 2026-05-19
CVE-2026-4021 Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion CWE-287 8.1 High 2026-03-23
CVE-2026-3180 Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection CWE-89 7.5 High 2026-03-02
CVE-2025-12849 Contest Gallery <= 28.0.2 - Missing Authorization CWE-862 5.3 Medium 2025-11-15
CVE-2025-11254 Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection CWE-1236 4.3 Medium 2025-10-11
CVE-2025-10383 Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.2 - Authenticated (Author+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2025-10-04
CVE-2025-7725 Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0 - Unauthenticated Stored Cross-Site Scripting CWE-79 7.2 High 2025-08-01
CVE-2025-6716 Contest Gallery <= 26.0.8 - Authenticated (Author+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2025-07-11
CVE-2025-3862 Contest Gallery <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter CWE-79 6.4 Medium 2025-05-08
CVE-2025-1513 Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 26.0.0.1 - Unauthenticated Stored Cross-Site Scripting CWE-79 7.2 High 2025-02-28
CVE-2024-11103 Contest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover CWE-640 9.8 Critical 2024-11-28
CVE-2024-10687 Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 24.0.3 - Unauthenticated SQL Injection CWE-89 9.8 Critical 2024-11-05

All 15 known CVE vulnerabilities affecting Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe with full Chinese analysis, references, and POCs where available.