WordPress contest-gallery has 27 known advisories in the phpwarden feed. Feed 2026.10.29.4, updated 2026-10-29.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2021-24915 | The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name | critical | 9.8 | <13.1.0.6 | 13.1.0.6 |
| CVE-2022-4156 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the user_id POST pa | high | 7.5 | <19.1.5.1 | 19.1.5.1 |
| CVE-2022-4160 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_copy_id POST | medium | 6.5 | <19.1.5.1 | 19.1.5.1 |
| CVE-2022-36394 | Authenticated (author+) SQL Injection (SQLi) vulnerability in Contest Gallery plugin <= 17.0.4 at WordPress. | high | 7.6 | <=17.0.4 | – |
| CVE-2022-4157 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_option_id PO | medium | 4.9 | <19.1.5.1 | 19.1.5.1 |
| CVE-2022-4158 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_Fields POST | high | 7.5 | <19.1.5.1 | 19.1.5.1 |
| CVE-2022-4150 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id POST | medium | 6.5 | <19.1.5.1 | 19.1.5.1 |
| CVE-2022-4151 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id GET p | medium | 6.5 | <19.1.5.1 | 19.1.5.1 |
| CVE-2022-4152 | The Contest Gallery WordPress plugin before 19.1.5, Contest Gallery Pro WordPress plugin before 19.1.5 do not escape the option_id POST para | medium | 6.5 | <19.1.5.1 | 19.1.5.1 |
| CVE-2022-4153 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the upload[] POST p | medium | 6.5 | <19.1.5.1 | 19.1.5.1 |
| CVE-2022-4159 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_id POST para | medium | 6.5 | <19.1.5.1 | 19.1.5.1 |
| CVE-2022-4161 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_copy_start P | medium | 6.5 | <19.1.5.1 | 19.1.5.1 |
| CVE-2022-4162 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_row POST par | medium | 6.5 | <19.1.5.1 | 19.1.5.1 |
| CVE-2022-4163 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_deactivate a | medium | 6.5 | <19.1.5.1 | 19.1.5.1 |
| CVE-2022-4164 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_multiple_fil | medium | 6.5 | <19.1.5.1 | 19.1.5.1 |
| CVE-2022-4165 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_order POST p | medium | 6.5 | <19.1.5.1 | 19.1.5.1 |
| CVE-2022-4166 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the addCountS POST | medium | 6.5 | <19.1.5.1 | 19.1.5.1 |
| CVE-2022-4154 | The Contest Gallery Pro WordPress plugin before 19.1.5 does not escape the wp_user_id GET parameter before concatenating it to an SQL query | medium | 4.9 | <19.1.5.1 | 19.1.5.1 |
| CVE-2022-4155 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the wp_user_id GET | medium | 4.9 | <19.1.5.1 | 19.1.5.1 |
| CVE-2024-11103 | The Contest Gallery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 24 | critical | 9.8 | <24.0.8 | 24.0.8 |
| CVE-2024-10687 | The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons plug | critical | 9.8 | <24.0.4 | 24.0.4 |
| CVE-2023-5307 | The Photos and Files Contest Gallery WordPress plugin before 21.2.8.1 does not sanitise and escape some parameters, which could allow unauth | medium | 6.1 | <21.2.8.1 | 21.2.8.1 |
| CVE-2022-45848 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 13.1.0.9 on WordPress. | medium | 6.1 | <=13.1.0.9 | – |
| CVE-2024-1487 | The Photos and Files Contest Gallery WordPress plugin before 21.3.1 does not sanitize and escape some parameters, which could allow users wi | medium | 5.4 | <21.3.1 | 21.3.1 |
| CVE-2025-3862 | Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and includin | medium | 6.4 | <26.0.7 | 26.0.7 |
| CVE-2025-1513 | The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Bu | high | 7.2 | <26.0.1 | 26.0.1 |
| CVE-2024-24887 | Cross-Site Request Forgery (CSRF) vulnerability in Contest Gallery Photos and Files Contest Gallery – Contact Form, Upload Form, Social Shar | medium | 5.4 | <21.2.9 | 21.2.9 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden wordpress /var/www/html # or, without Composer pipx install phpwarden && phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked