Contest Gallery vulnerabilities

6 vulnerabilities

Known vulnerabilities in Contest Gallery products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3 products.

Products

3
9.8CVE-2021-24915contest_gallerycontest_gallery+2
EPSS score
11.55%
The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address8.8CVE-2022-36394contest gallerycontest gallery (wordpress plugin)+2
EPSS score
0.98%
Authenticated (author+) SQL Injection (SQLi) vulnerability in Contest Gallery plugin <= 17.0.4 at WordPress.6.4CVE-2022-27853contest gallerycontest gallery (wordpress plugin)+2
EPSS score
0.53%
Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) in Contest Gallery (WordPress plugin) <= 13.1.0.96.1CVE-2022-45848contest_gallerycontest_gallery+2
EPSS score
0.43%
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 13.1.0.9 on WordPress.8.8CVE-2024-24887contest galleryphotos and files contest gallery – contact form, upload form, social share and voting plugin for wordpress+2
EPSS score
0.21%
Cross-Site Request Forgery (CSRF) vulnerability in Contest Gallery Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress.This issue affects Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress: from n/a through 21.2.8.4.7.1CVE-2023-28784contest_gallerycontest_gallery+2
EPSS score
0.38%
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 21.1.2 versions.