Contest Gallery
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:contest_gallery:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Contest Gallery (2eccafda-a1c4-523c-ba3c-22c92ba5c134) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-107447 |
vulnerable | 2026-11-03 10:15:59.441779 |
Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter Identity
MEDIUM (5.3)
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and cast multiple votes for the same contest entry, inflating its vote total.
Published: 2026-10-21T08:38:58.748Z
Updated: 2026-10-21T10:14:55.080Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16055 |
vulnerable | 2026-09-16 04:32:57.152025 |
Contest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_login
The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication Contest Gallery WordPress plugin before 30.0.7 and enables unlimited, unthrottled password guessing against any account (including administrators) up to full account takeover.
Published: 2026-08-05T06:00:12.744Z
Updated: 2026-08-05T14:04:53.010Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16056 |
vulnerable | 2026-09-16 04:32:56.562113 |
Contest Gallery < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_prompts
The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history.
Published: 2026-08-04T06:00:11.408Z
Updated: 2026-08-04T17:38:24.784Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16057 |
vulnerable | 2026-09-16 04:32:56.479568 |
Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other content they do not own.
Published: 2026-08-03T06:00:10.227Z
Updated: 2026-08-04T17:42:06.222Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4166 |
vulnerable | 2026-06-08 05:51:36.917929 |
Contest Gallery < 19.1.5 - Author+ SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the addCountS POST parameter before concatenating it to an SQL query in 4_activate.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Published: 2022-12-26T12:28:04.308Z
Updated: 2025-04-11T23:13:55.632Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4165 |
vulnerable | 2026-06-08 05:51:36.917407 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4164 |
vulnerable | 2026-06-08 05:51:36.916985 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4163 |
vulnerable | 2026-06-08 05:51:36.916243 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4162 |
vulnerable | 2026-06-08 05:51:36.915674 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4161 |
vulnerable | 2026-06-08 05:51:36.915257 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4160 |
vulnerable | 2026-06-08 05:51:36.914693 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4159 |
vulnerable | 2026-06-08 05:51:36.914100 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4158 |
vulnerable | 2026-06-08 05:51:36.913588 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4157 |
vulnerable | 2026-06-08 05:51:36.912981 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4156 |
vulnerable | 2026-06-08 05:51:36.912367 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4155 |
vulnerable | 2026-06-08 05:51:36.911835 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4153 |
vulnerable | 2026-06-08 05:51:36.910866 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4152 |
vulnerable | 2026-06-08 05:51:36.910315 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4151 |
vulnerable | 2026-06-08 05:51:36.909555 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4150 |
vulnerable | 2026-06-08 05:51:36.906965 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.